PT-2023-4087 · Sap · Sap S/4Hana+1

Published 2023-07-10 · Updated 2023-12-09 · CVE-2023-36922

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP ECC and SAP S/4HANA (affected versions not specified)

Description The issue is related to a programming error in the function module and report of the IS-OIL component, allowing an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common extension. Successful exploitation can enable the attacker to read or modify system data and shut down the system. The vulnerability is associated with the lack of measures to neutralize special elements, which can allow a remote attacker to execute an arbitrary command.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2023-04387

CVE-2023-36922

Affected Products

Sap Ecc

Sap S/4Hana

References · 10

• https://osv.dev/vulnerability/CVE-2023-36922 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04387 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-36922 · Security Note
• https://sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html · Vendor Advisory
• https://me.sap.com/notes/3350297 · Note
• https://blogs.sap.com/2023/07/11/sap-security-patch-day-july-2023 · Note
• https://t.me/cvenotify/63098 · Telegram Post
• https://t.me/true_secator/4608 · Telegram Post
• https://cybersecurity-help.cz/vdb/SB2023072754 · Note
• https://github.com/advisories/GHSA-4qhp-mwrw-89jx · Note