critical9.1
CVE-2023-36922
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary ope…
Impact
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sap | Netweaver | Versions 600, 602, 603, 604, 605, 606 |