Description
UPDATE 12th November 2019: The SAP security note 2839864 replaces the corrections provided in this security note.
This SAP security note replaces the corrections provided in security note 2808158
The OS Command Plugin in the transaction GPA_ADMIN and the OSCommand Console allow an attacker to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
Some well-known impacts of Code Injection vulnerability are
- Unauthorized execution of commands
- Sensitive information disclosure
- Denial of Service
Available fix and Supported packages
- LM-SERVICE | 7.20 | 7.20
- SOLMANDIAG 720 | SP003 | 000006
- SOLMANDIAG 720 | SP004 | 000010
- SOLMANDIAG 720 | SP005 | 000011
- SOLMANDIAG 720 | SP006 | 000010
- SOLMANDIAG 720 | SP007 | 000012
- SOLMANDIAG 720 | SP008 | 000010
- SOLMANDIAG 720 | SP009 | 000001
Affected component
- SV-SMG-DIA-SRV-AGT
Agent Framework
CVSS
Score: 9.1
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2823733
