CVE-2023-26458
Last modified
CVE-2023-26458 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system. . EPSS estimates a 0.56% chance of exploitation in the next 30 days.
Description
An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Sap | Landscape Management | 3.0 |
References
- https://launchpad.support.sap.com/#/notes/3312733Permissions Required
- https://launchpad.support.sap.com/#/notes/3312733Permissions Required
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2023-26458?
How severe is CVE-2023-26458?
How do I fix CVE-2023-26458?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2023
- CVE-2023-26452Requests to cache an image and return its metadata could be …8.8
- CVE-2023-26453Requests to cache an image could be abused to include SQL qu…8.8
- CVE-2023-26454Requests to fetch image metadata could be abused to include …8.8
- CVE-2023-26455RMI was not requiring authentication when calling ChronosRMI…7.8
- CVE-2023-26456Users were able to set an arbitrary "product name" for OX Gu…5.4
- CVE-2023-26457SAP Content Server - version 7.53, does not sufficiently enc…6.1
- CVE-2023-26459Due to improper input controls In SAP NetWeaver AS for ABAP …7.4
- CVE-2023-2646A vulnerability has been found in TP-Link Archer C7v2 v2_en_…4.5
- CVE-2023-26460Cache Management Service in SAP NetWeaver Application Server…5.3
- CVE-2023-26461SAP NetWeaver allows (SAP Enterprise Portal) - version 7.50,…4.9
- CVE-2023-26462ThingsBoard 3.4.1 could allow a remote attacker to gain elev…8.1
- CVE-2023-26463strongSwan 5.9.8 and 5.9.9 potentially allows remote code ex…9.8
Are you affected by CVE-2023-26458?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST