CVE-2023-36922 — OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system comm…
Published: 2023-07-11 · CVSS: 9.1 · CVSS 3.1
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7