CVE-2020-6183

SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to…

Medium5.3EPSS 0.69%

Published: 12 Feb 2020
Updated: 4 Aug 2024
Reserved: 8 Jan 2020
Assigned by: sap

Description

SAP Host Agent, version 7.21, allows an unprivileged user to read the shared memory or write to the shared memory by sending request to the main SAPOSCOL process and receive responses that may contain data read with user root privileges e.g. size of any directory, system hardware and OS details, leading to Missing Authorization Check vulnerability.

Timeline

2020
8 Jan 2020
8 Jan 2020
ID reserved
By sap
12 Feb 202035 days later
12 Feb 2020· 35 days later
Published
2024
4 Aug 20244 years later
4 Aug 2024· 4 years later
Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2020-6183, by who scored it
Scored by	CVSS	Score	Vector
sapCNA (assigner)	3.0	Medium5.3	CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVDNVD · Modified	3.1	Medium6.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

EPSS (exploitation in 30 days): 0.69% · top 47% of all CVEs (7 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.3.

Weakness

Missing Authorization Check
CWE-862 (opens in a new tab)All about CWE-862 and its CVEs

Affected products

SAP SE · SAP Host Agent
- affected = 7.21

References (2)

https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=537788812 (opens in a new tab)x_refsource_MISCx_transferred
https://launchpad.support.sap.com/#/notes/2836445 (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2020-6183](https://trackcve.app/badge/CVE-2020-6183.svg)](https://trackcve.app/cve/CVE-2020-6183)

Record last updated 4 Aug 2024, 08:55 UTC.