Description
An attacker with admin privileges could run malicious executables with root privileges in SAP Host Agent via SAP Landscape Management due to missing input validation.
Available fix and Supported packages
- VCM | 3.00 | 3.00
- SAPACEXT | 1.00 | 1.00
- SAPACEXT | 1.00EXT | 1.00EXT
- SAP ADAPTIVE EXTENSION 1.0 EXT | SP000 | 000051
- SAP ADAPTIVE EXTENSIONS 1.0 | SP000 | 000051
- VCM LVM 3.0 | SP013 | 000003
Affected component
- BC-VCM-LVM
Landscape Virtualization Management
CVSS
Score: 7.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2878030
