CVE-2023-36922 OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Authenticated attackers can inject OS commands in SAP ECC and S/4HANA IS-OIL to read, modify, or shut down system data.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-36922?
CVE-2023-36922 is a critical command injection vulnerability in Sap Netweaver, published on 11 Jul 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Weakness: CWE-78
Which versions are affected by CVE-2023-36922?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2023-36922?
No fix has been published for CVE-2023-36922 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2023-36922 being exploited?
There is no known exploitation of CVE-2023-36922 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-4qhp-mwrw-89jx.