« Volver al listado

CVE-2023-36924

Estado: ModificadaMedia (4.9)—

While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — ERP Defense Forces AND Public Security

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-36924",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2023-36924",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-23T16:16:25.491312Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 4.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.2
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP ERP Defense Forces and Public Security",
          "versions": [
            {
              "status": "affected",
              "version": "600"
            },
            {
              "status": "affected",
              "version": "603"
            },
            {
              "status": "affected",
              "version": "604"
            },
            {
              "status": "affected",
              "version": "605"
            },
            {
              "status": "affected",
              "version": "616"
            },
            {
              "status": "affected",
              "version": "617"
            },
            {
              "status": "affected",
              "version": "618"
            },
            {
              "status": "affected",
              "version": "802"
            },
            {
              "status": "affected",
              "version": "803"
            },
            {
              "status": "affected",
              "version": "804"
            },
            {
              "status": "affected",
              "version": "805"
            },
            {
              "status": "affected",
              "version": "806"
            },
            {
              "status": "affected",
              "version": "807"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-07-11T03:15:10.417",
  "references": [
    {
      "url": "https://me.sap.com/notes/3351410",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3351410",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-117"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.\n\n"
    }
  ],
  "lastModified": "2026-06-17T06:07:23.510",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:600:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "165083A6-F783-4DF8-BACA-F8322127B367"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:603:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EB212350-1381-411E-A8EF-E42DE7F456AC"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:604:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94C10D8C-34AB-435B-A5CD-24BEBCC626ED"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:605:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "211D94F2-4D3F-4BD5-B072-7B6759159B5F"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:616:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A64661D0-94E6-4F55-AB7A-055E10A799DD"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:617:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "89E96E9D-A9EF-4A55-9DC1-755B97768B29"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:618:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1B9EBD4C-AFCD-4B4F-AB57-FE00C21F2B61"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:802:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "67FF541F-7B4D-48A8-8CAF-D4B5923B3631"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:803:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BC80872A-80F9-496C-AE97-958E8FCE0BCE"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:804:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92030B39-9065-4EE3-8475-B86FBB1B622D"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:805:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C31AEB42-A823-4344-8135-ACA063E4C41A"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:806:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F2CD6245-D1FE-41A2-8295-E69F331428CB"
            },
            {
              "criteria": "cpe:2.3:a:sap:erp_defense_forces_and_public_security:807:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FB9AC6AC-455D-40E7-AD6B-47FCEB5B4D5A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}