CVE-2023-36922
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
Due to a programming error in function module and report, the IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Risk Assessment
This vulnerability poses a serious risk to organizations, allowing an attacker to access sensitive data and modify it, potentially disrupting system operations.
Recommendation
It is recommended to immediately update the system to the latest version to eliminate this vulnerability and implement additional security measures such as monitoring and restricting access to critical parameters.
Original NVD description (English source)
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.