Riskcovery

CVE-2023-36922

OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

State
Published
Severity
9.1 Critical
Published
Jul 11, 2023
Updated
Aug 2, 2024
Reserved
Jun 27, 2023

Read the record on cve.org

Description

Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.

Scores

CVSSScoreVectorSource
3.19.1 CriticalCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:Hsap

Weaknesses

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Affected Products

ProductVersions
SAP ECC and SAP S/4HANA (IS-OIL)SAP_SE
  • IS-OIL 600Affected
  • IS-OIL 602Affected
  • IS-OIL 603Affected
  • IS-OIL 604Affected
  • IS-OIL 605Affected
  • IS-OIL 606Affected
  • IS-OIL 617Affected
  • IS-OIL 618Affected
  • IS-OIL 800Affected
  • IS-OIL 802Affected
  • IS-OIL 803Affected
  • IS-OIL 804Affected
  • IS-OIL 805Affected
  • IS-OIL 806Affected
  • IS-OIL 807Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.