Landscape Management
CVE-2020-6236
HIGH
Severity by source
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionNVD
SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results in the possibility to execute these files as root user from a non-root context, leading to Privilege Escalation.
AnalysisAI
SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Technical ContextAI
This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ownership and permissions (including S-user ID bit s-bit) of arbitrary files remotely. This results in the possibility to execute these files as root user from a non-root context, leading to Privilege Escalation. Affected products include: Sap Adaptive Extensions, Sap Landscape Management. Version information: version 3.0.
RemediationAI
No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply principle of least privilege, validate privilege transitions, implement proper role separation.
More in Landscape Management
View allUnder certain circumstances, SAP HANA Extended Application Services, advanced model (XS advanced) does not perform authe
An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. Rated high
Under certain conditions SAP Landscape Management (VCM 3.0) allows an attacker to access information which would otherwi
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious commands with root
SAP Landscape Management, version 3.0, allows an attacker with admin privileges to execute malicious executables with ro
SAP Landscape Management allows an authenticated user to read confidential data disclosed by the REST Provider Definitio
Under certain conditions, SAP Landscape Management enterprise edition, before version 3.0, allows custom secure paramete
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today