PT-2023-4087 · Sap · Sap S/4Hana+1

CVE-2023-36922 · Publicado 2023-07-10 · Atualizado 2023-12-09

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP ECC and SAP S/4HANA (affected versions not specified)

Description The issue is related to a programming error in the function module and report of the IS-OIL component, allowing an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common extension. Successful exploitation can enable the attacker to read or modify system data and shut down the system. The vulnerability is associated with the lack of measures to neutralize special elements, which can allow a remote attacker to execute an arbitrary command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

BDU:2023-04387

CVE-2023-36922

Produtos afetados

Sap Ecc

Sap S/4Hana

Referências · 10

• https://osv.dev/vulnerability/CVE-2023-36922 · Aviso do Fabricante
• https://me.sap.com/notes/3350297 · Nota
• https://bdu.fstec.ru/vul/2023-04387 · Nota de Segurança
• https://blogs.sap.com/2023/07/11/sap-security-patch-day-july-2023 · Nota
• https://t.me/cvenotify/63098 · Publicação no Telegram
• https://t.me/true_secator/4608 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-36922 · Nota de Segurança
• https://cybersecurity-help.cz/vdb/SB2023072754 · Nota
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Aviso do Fabricante
• https://github.com/advisories/GHSA-4qhp-mwrw-89jx · Nota