SAP ECC

IS-OIL 604

OTHER 1 CVE

IS-OIL 603

OTHER 1 CVE

IS-OIL 606

OTHER 1 CVE

IS-OIL 617

OTHER 1 CVE

IS-OIL 807

OTHER 1 CVE

IS-OIL 600

OTHER 1 CVE

IS-OIL 602

OTHER 1 CVE

IS-OIL 805

OTHER 1 CVE

IS-OIL 802

OTHER 1 CVE

IS-OIL 804

OTHER 1 CVE

IS-OIL 618

OTHER 1 CVE

IS-OIL 605

OTHER 1 CVE

IS-OIL 806

OTHER 1 CVE

IS-OIL 803

OTHER 1 CVE

IS-OIL 800

OTHER 1 CVE

CVE-2023-36922

Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.

CRITICAL Jul 11, 2023