CVE-2023-26458 MEDIUM

CVE-2023-26458: Information Disclosure vulnerability in SAP Landscape Management

Vendor Sap
Product Landscape Management
Weakness CWE-668
Published April 11, 2023
Last update February 7, 2025

CVSS base score

6.8/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.The disclosed information is for Diagnostics Agent Connection via Java SCS Message Server of an SAP Solution Manager system and can only be accessed by authenticated SAP Landscape Management users, but they can escalate their privileges to the SAP Solution Manager system.

Key dates

02Disclosure timeline

April 11, 2023 CVE published
February 7, 2025 Record updated