60
CVE-2023-36922
- CVSS 3.1
- 8.8 high
- EPSS
- <1%p56
- Published
- ·
- Modified
Description · NVD
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.