Skip to content
CVE PROGRAM SOURCE RECORD9.1 Critical

CVE-2023-36922

OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
sap

Description

Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

SAP_SE SAP ECC and SAP S/4HANA (IS-OIL)

Default version status: unaffected

  • IS-OIL 600affected
  • IS-OIL 602affected
  • IS-OIL 603affected
  • IS-OIL 604affected
  • IS-OIL 605affected
  • IS-OIL 606affected
  • IS-OIL 617affected
  • IS-OIL 618affected
  • IS-OIL 800affected
  • IS-OIL 802affected
  • IS-OIL 803affected
  • IS-OIL 804affected
  • IS-OIL 805affected
  • IS-OIL 806affected
  • IS-OIL 807affected

References