Description
UPDATE 12th November 2019: The SAP security note 2839864 replaces the corrections provided in this security note
UPDATE 10th September 2019: The SAP security note 2823733 replaces the corrections provided in this security note.
The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Some well-known impacts of Code Injection vulnerability are
- Unauthorized execution of commands
- Sensitive information disclosure
- Denial of Service
Available fix and Supported packages
- LM-SERVICE | 7.20 | 7.20
- SOLMANDIAG 720 | SP005 | 000010
- SOLMANDIAG 720 | SP006 | 000009
- SOLMANDIAG 720 | SP007 | 000011
- SOLMANDIAG 720 | SP008 | 000008
- SOLMANDIAG 720 | SP009 | 000000
Affected component
- SV-SMG-DIA-SRV-AGT
Agent Framework
CVSS
Score: 9.1
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2808158
