It’s a hot 0-day summer for Apple, Google, and Microsoft security fixes
60
CVE-2023-36922
—CVSS 3.1
8.8 high
EPSS
<1%p56
Published
()
Modified
Description
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
- Vendors
- sap
- Products
- netweaver
- Weakness
- CWE-78
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H