CVE-2023-36922
high-risk
Published 2023-07-11
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Do I need to act?
-
0.21% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
9
CVSS 9.1/10
Critical
NETWORK
/ LOW complexity
Affected Products (15)
Affected Vendors
References (4)
Permissions Required
https://me.sap.com/notes/3350297
Permissions Required
https://me.sap.com/notes/3350297
50
/ 100
high-risk
Severity
31/34 · Critical
Exploitability
1/34 · Minimal
Exposure
18/34 · Moderate