CVE-2023-36922

{"id": "CVE-2023-36922", "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-07-11T03:15:10.357", "references": [{"url": "https://me.sap.com/notes/3350297", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}, {"url": "https://me.sap.com/notes/3350297", "tags": ["Permissions Required"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-78"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. \u00a0On successful exploitation, the attacker can read or modify the system data as well as shut down the system.\n\n"}], "lastModified": "2024-11-21T08:10:55.903", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver:600:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BDC771C8-70C7-4EA4-BF13-9153175F652F"}, {"criteria": "cpe:2.3:a:sap:netweaver:602:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D95174DD-6513-469F-911D-61FEF490BF44"}, {"criteria": "cpe:2.3:a:sap:netweaver:603:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A78F0A5A-514B-49C6-82E1-788049D4624A"}, {"criteria": "cpe:2.3:a:sap:netweaver:604:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "92CF95AB-7222-4BB9-A01B-CC9BB0548DBE"}, {"criteria": "cpe:2.3:a:sap:netweaver:605:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8941EEEA-F588-419D-A72C-177A669D450B"}, {"criteria": "cpe:2.3:a:sap:netweaver:606:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "94616B3E-ADE0-45E2-A3B8-B545E7E0BB0F"}, {"criteria": "cpe:2.3:a:sap:netweaver:617:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "345E8B05-AE80-401D-895D-918136E5D738"}, {"criteria": "cpe:2.3:a:sap:netweaver:618:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6B5038E3-5515-41C5-8C89-D839D5AE60DF"}, {"criteria": "cpe:2.3:a:sap:netweaver:800:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4BE09533-102E-492F-ACAE-5B959885EE45"}, {"criteria": "cpe:2.3:a:sap:netweaver:802:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "70FA0AC8-D377-4800-9365-2EAD15C108C9"}, {"criteria": "cpe:2.3:a:sap:netweaver:803:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "364A7BFE-3EAE-4897-B198-BEE1DCEB2163"}, {"criteria": "cpe:2.3:a:sap:netweaver:804:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2A119858-00D2-44CA-9C9D-9BEAFC8BD3CD"}, {"criteria": "cpe:2.3:a:sap:netweaver:805:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5781D666-9439-4D4D-A0F6-DDA6763439CE"}, {"criteria": "cpe:2.3:a:sap:netweaver:806:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "19188AD7-2B5F-48E9-81B2-30A60F009432"}, {"criteria": "cpe:2.3:a:sap:netweaver:807:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5C4EDC18-FBD1-473C-82F8-940097CE8C1C"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}