CVE-2020-6234

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

SAP Host Agent, version 7.21, allows an attacker with admin privileges to use the operation framework to gain root privileges over the underlying operating system, leading to Privilege Escalation.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
SAP SE	SAP Host Agent	< 7.21

References

http://packetstormsecurity.com/files/162084/SAP-Host-Control-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Apr/5Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2902645Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202Vendor Advisory
http://packetstormsecurity.com/files/162084/SAP-Host-Control-Local-Privilege-Escalation.htmlThird Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2021/Apr/5Mailing List, Third Party Advisory
https://launchpad.support.sap.com/#/notes/2902645Permissions Required, Vendor Advisory
https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=544214202Vendor Advisory

Timeline

Published: Apr 14, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-62358.6SAP Solution Manager (Diagnostics Agent), version 7.2, does not perform the authentication check for the functionalities of the Collector Si CVE-2020-62367.2SAP Landscape Management, version 3.0, and SAP Adaptive Extensions, version 1.0, allows an attacker with admin_group privileges to change ow CVE-2020-62377.5Under certain conditions, SAP Business Objects Business Intelligence Platform, version 4.1, 4.2, dswsbobje web application allows an attacke CVE-2020-62389.3SAP Commerce, versions - 6.6, 6.7, 1808, 1811, 1905, does not process XML input securely in the Rest API from Servlet xyformsweb, leading to CVE-2020-62394.4Under certain conditions SAP Business One (Backup service), versions 9.3, 10.0, allows an attacker with admin permissions to view SYSTEM use CVE-2020-62407.5SAP NetWeaver AS ABAP (Web Dynpro ABAP), versions (SAP_UI 750, 752, 753, 754 and SAP_BASIS 700, 710, 730, 731, 804) allows an unauthenticate CVE-2020-62418.8SAP Adaptive Server Enterprise, version 16.0, allows an authenticated user to execute crafted database queries to elevate privileges of user CVE-2020-62429.8SAP Business Objects Business Intelligence Platform (Live Data Connect), versions 1.0, 2.0, 2.1, 2.2, 2.3, allows an attacker to logon on th CVE-2020-62438.8Under certain conditions, SAP Adaptive Server Enterprise (XP Server on Windows Platform), versions 15.7, 16.0, does not perform the necessar CVE-2020-62447.8SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in CVE-2020-62456.7SAP Business Objects Business Intelligence Platform, version 4.2, allows an attacker with access to local instance, to inject file or code t CVE-2020-62466.1SAP NetWeaver AS ABAP Business Server Pages Test Application SBSPEXT_TABLE, versions 700, 701, 702, 730, 731, 740, 750, 751, 752, 753, 754,