« Volver al listado

CVE-2023-36922

Estado: ModificadaAlta (8.8)—

Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

SAP — Netweaver

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2023-36922",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cna@sap.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 9.1,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 6,
        "exploitabilityScore": 2.3
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cna@sap.com",
      "affectedData": [
        {
          "vendor": "SAP_SE",
          "product": "SAP ECC and SAP S/4HANA (IS-OIL)",
          "versions": [
            {
              "status": "affected",
              "version": "IS-OIL 600"
            },
            {
              "status": "affected",
              "version": "IS-OIL 602"
            },
            {
              "status": "affected",
              "version": "IS-OIL 603"
            },
            {
              "status": "affected",
              "version": "IS-OIL 604"
            },
            {
              "status": "affected",
              "version": "IS-OIL 605"
            },
            {
              "status": "affected",
              "version": "IS-OIL 606"
            },
            {
              "status": "affected",
              "version": "IS-OIL 617"
            },
            {
              "status": "affected",
              "version": "IS-OIL 618"
            },
            {
              "status": "affected",
              "version": "IS-OIL 800"
            },
            {
              "status": "affected",
              "version": "IS-OIL 802"
            },
            {
              "status": "affected",
              "version": "IS-OIL 803"
            },
            {
              "status": "affected",
              "version": "IS-OIL 804"
            },
            {
              "status": "affected",
              "version": "IS-OIL 805"
            },
            {
              "status": "affected",
              "version": "IS-OIL 806"
            },
            {
              "status": "affected",
              "version": "IS-OIL 807"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2023-07-11T03:15:10.357",
  "references": [
    {
      "url": "https://me.sap.com/notes/3350297",
      "tags": [
        "Permissions Required"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cna@sap.com"
    },
    {
      "url": "https://me.sap.com/notes/3350297",
      "tags": [
        "Permissions Required"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cna@sap.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.\n\n"
    }
  ],
  "lastModified": "2026-06-17T06:07:23.157",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:sap:netweaver:600:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BDC771C8-70C7-4EA4-BF13-9153175F652F"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:602:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D95174DD-6513-469F-911D-61FEF490BF44"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:603:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A78F0A5A-514B-49C6-82E1-788049D4624A"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:604:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92CF95AB-7222-4BB9-A01B-CC9BB0548DBE"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:605:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8941EEEA-F588-419D-A72C-177A669D450B"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:606:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "94616B3E-ADE0-45E2-A3B8-B545E7E0BB0F"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:617:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "345E8B05-AE80-401D-895D-918136E5D738"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:618:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B5038E3-5515-41C5-8C89-D839D5AE60DF"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:800:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4BE09533-102E-492F-ACAE-5B959885EE45"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:802:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70FA0AC8-D377-4800-9365-2EAD15C108C9"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:803:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "364A7BFE-3EAE-4897-B198-BEE1DCEB2163"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:804:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2A119858-00D2-44CA-9C9D-9BEAFC8BD3CD"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:805:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5781D666-9439-4D4D-A0F6-DDA6763439CE"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:806:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "19188AD7-2B5F-48E9-81B2-30A60F009432"
            },
            {
              "criteria": "cpe:2.3:a:sap:netweaver:807:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5C4EDC18-FBD1-473C-82F8-940097CE8C1C"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cna@sap.com"
}