On 10.01.2023 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Host Agent.
SAP Note 3276120 addresses "[CVE-2023-0012] Local Privilege Escalation in SAP Host Agent (Windows)" to prevent code injection with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Risk specificationAn attacker who gains local membership to SAP_LocalAdmin could be able to replace executables with a malicious file that will be started under a privileged account.
The local privilege escalation is no longer possible
The advisory is valid for
- 9.9 [CVE-2023-0022] Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP)
- 8.8 [CVE-2023-27893] Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI)
- 7.0 [CVE-2022-41211] Arbitrary Code Execution vulnerability in SAP 3D Visual Enterprise Author and SAP 3D Visual Enterprise Viewer
- 5.4 [CVE-2023-23851] Unrestricted File Upload in SAP Business Planning and Consolidation