Lucene search
PRIOn knowledge basePRION:CVE-2023-36922HistoryJul 11, 2023 - 3:15 a.m.
Design/Logic Flaw
2023-07-1103:15:00
PRIOn knowledge base
www.prio-n.com
9
programming error
is-oil component
sap ecc
sap s/4hana
authenticated attacker
arbitrary operating system command
data compromise
system shutdown
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
