CVE-2023-26458CWE-668

Information Disclosure vulnerability in SAP Landscape Management

Medium · published April 11, 2023

CVSS v3.1
6.8
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.

The record
Technical detail
CVSS v3.1
6.8 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00555 · 45.6th percentile
Weakness
CWE-668 · Exposure of Resource to Wrong Sphere
Published
2023-04-11T02:34Z
EPSS history
Timeline
  • 11 APR 02:34Z
    Information Disclosure vulnerability in SAP Landscape Management
    cvelistv5