CVE-2023-36926: 
Sap Host Agent vulnerability analysis and mitigation

A vulnerability in SAP Host Agent version 7.22 (CVE-2023-36926) was identified where an unauthenticated attacker can exploit a missing authentication check. The vulnerability allows attackers to set an undocumented parameter to a specific compatibility value and call read functions, enabling them to gather non-sensitive information about the server (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 5.3 (MEDIUM) by NIST with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N, while SAP SE rated it as 3.7 (LOW) with vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N. The vulnerability is classified under CWE-287 (Improper Authentication) and CWE-306 (Missing Authentication for Critical Function) (NVD).

The vulnerability's impact is limited to confidentiality, allowing attackers to gather non-sensitive information about the server. There is no impact on system integrity or availability (NVD).

The vulnerability can be exploited by an unauthenticated attacker remotely by setting an undocumented parameter to a particular compatibility value, which then enables access to read functions (NVD).