CVE-2023-27498 Memory Corruption vulnerability in SAP Host Agent (SAPOSCOL)
Unauthenticated attackers can trigger memory corruption in SAP Host Agent to disclose technical information and cause temporary service unavailability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-27498?
CVE-2023-27498 is a high-severity memory corruption vulnerability in Host Agent (SAPOSCOL), published on 14 Mar 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a crafted request which results in a memory corruption error. This error can be used to reveal but not modify any technical information about the server. It can also make a particular service temporarily unavailable
Weakness: CWE-121
Which versions are affected by CVE-2023-27498?
It affects 1 product.
Products include Sap Host Agent.
How do I fix CVE-2023-27498?
No fix has been published for CVE-2023-27498 yet. Limit exposure of the affected software until one is available.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2023-27498 being exploited?
There is no known exploitation of CVE-2023-27498 in the wild and no public exploit code.
Other vulnerabilities in Host Agent (SAPOSCOL)
Sources
Also known as GHSA-c2vj-pg8r-rj75.