CVE-2023-36926 Information disclosure vulnerability in SAP Host Agent

What is CVE-2023-36926?

CVE-2023-36926 is a low-severity missing authorization vulnerability in SAP_SE SAP Host Agent, published on 8 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Due to missing authentication check in SAP Host Agent - version 7.22, an unauthenticated attacker can set an undocumented parameter to a particular compatibility value and in turn call read functions. This allows the attacker to gather some non-sensitive information about the server.  There is no impact on integrity or availability.

Weakness: CWE-287, CWE-306

Which versions are affected by CVE-2023-36926?

It affects 1 product.

Products include Sap Host Agent.

How do I fix CVE-2023-36926?

No fix has been published for CVE-2023-36926 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-36926 being exploited?

There is no known exploitation of CVE-2023-36926 in the wild and no public exploit code.

Other vulnerabilities in SAP_SE SAP Host Agent

• CVE-2023-24523 Command injection in Host Agent Service High 8.8
• CVE-2020-6186 Denial of service in SAP Host Agent High 7.5
• CVE-2017-15297 Auth bypass in n/a High 7.5
• CVE-2023-27498 Memory Corruption vulnerability in SAP Host Agent (SAPOSCOL) High 7.2
• CVE-2020-6234 Privilege escalation in SAP Host Agent High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-8qg9-9fqc-xjj6.