GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2023-36922 (GCVE-0-2023-36922)

Vulnerability from cvelistv5 – Published: 2023-07-11 02:56 – Updated: 2024-08-02 17:01
VLAI
Title
OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
Summary
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Severity
9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE
  • CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Assigner
References
Impacted products
Vendor Product Version CPE status
SAP_SE SAP ECC and SAP S/4HANA (IS-OIL) Affected: IS-OIL 600
Affected: IS-OIL 602
Affected: IS-OIL 603
Affected: IS-OIL 604
Affected: IS-OIL 605
Affected: IS-OIL 606
Affected: IS-OIL 617
Affected: IS-OIL 618
Affected: IS-OIL 800
Affected: IS-OIL 802
Affected: IS-OIL 803
Affected: IS-OIL 804
Affected: IS-OIL 805
Affected: IS-OIL 806
Affected: IS-OIL 807
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.981Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://me.sap.com/notes/3350297"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SAP ECC and SAP S/4HANA (IS-OIL)",
          "vendor": "SAP_SE",
          "versions": [
            {
              "status": "affected",
              "version": "IS-OIL 600"
            },
            {
              "status": "affected",
              "version": "IS-OIL 602"
            },
            {
              "status": "affected",
              "version": "IS-OIL 603"
            },
            {
              "status": "affected",
              "version": "IS-OIL 604"
            },
            {
              "status": "affected",
              "version": "IS-OIL 605"
            },
            {
              "status": "affected",
              "version": "IS-OIL 606"
            },
            {
              "status": "affected",
              "version": "IS-OIL 617"
            },
            {
              "status": "affected",
              "version": "IS-OIL 618"
            },
            {
              "status": "affected",
              "version": "IS-OIL 800"
            },
            {
              "status": "affected",
              "version": "IS-OIL 802"
            },
            {
              "status": "affected",
              "version": "IS-OIL 803"
            },
            {
              "status": "affected",
              "version": "IS-OIL 804"
            },
            {
              "status": "affected",
              "version": "IS-OIL 805"
            },
            {
              "status": "affected",
              "version": "IS-OIL 806"
            },
            {
              "status": "affected",
              "version": "IS-OIL 807"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eDue to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. \u0026nbsp;On successful exploitation, the attacker can read or modify the system data as well as shut down the system.\u003c/span\u003e\u003c/p\u003e"
            }
          ],
          "value": "Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. \u00a0On successful exploitation, the attacker can read or modify the system data as well as shut down the system.\n\n"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "eng",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-12-09T16:39:50.007Z",
        "orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
        "shortName": "sap"
      },
      "references": [
        {
          "url": "https://me.sap.com/notes/3350297"
        },
        {
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)",
      "x_generator": {
        "engine": "Vulnogram 0.1.0-dev"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd",
    "assignerShortName": "sap",
    "cveId": "CVE-2023-36922",
    "datePublished": "2023-07-11T02:56:55.299Z",
    "dateReserved": "2023-06-27T21:23:26.299Z",
    "dateUpdated": "2024-08-02T17:01:09.981Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2023-36922",
      "date": "2026-09-19",
      "epss": "0.00845",
      "percentile": "0.56435"
    },
    "fkie_nvd": {
      "configurations": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:600:*:*:*:*:*:*:*",
                  "matchCriteriaId": "BDC771C8-70C7-4EA4-BF13-9153175F652F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:602:*:*:*:*:*:*:*",
                  "matchCriteriaId": "D95174DD-6513-469F-911D-61FEF490BF44",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:603:*:*:*:*:*:*:*",
                  "matchCriteriaId": "A78F0A5A-514B-49C6-82E1-788049D4624A",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:604:*:*:*:*:*:*:*",
                  "matchCriteriaId": "92CF95AB-7222-4BB9-A01B-CC9BB0548DBE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:605:*:*:*:*:*:*:*",
                  "matchCriteriaId": "8941EEEA-F588-419D-A72C-177A669D450B",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:606:*:*:*:*:*:*:*",
                  "matchCriteriaId": "94616B3E-ADE0-45E2-A3B8-B545E7E0BB0F",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:617:*:*:*:*:*:*:*",
                  "matchCriteriaId": "345E8B05-AE80-401D-895D-918136E5D738",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:618:*:*:*:*:*:*:*",
                  "matchCriteriaId": "6B5038E3-5515-41C5-8C89-D839D5AE60DF",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:800:*:*:*:*:*:*:*",
                  "matchCriteriaId": "4BE09533-102E-492F-ACAE-5B959885EE45",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:802:*:*:*:*:*:*:*",
                  "matchCriteriaId": "70FA0AC8-D377-4800-9365-2EAD15C108C9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:803:*:*:*:*:*:*:*",
                  "matchCriteriaId": "364A7BFE-3EAE-4897-B198-BEE1DCEB2163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:804:*:*:*:*:*:*:*",
                  "matchCriteriaId": "2A119858-00D2-44CA-9C9D-9BEAFC8BD3CD",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:805:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5781D666-9439-4D4D-A0F6-DDA6763439CE",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:806:*:*:*:*:*:*:*",
                  "matchCriteriaId": "19188AD7-2B5F-48E9-81B2-30A60F009432",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:sap:netweaver:807:*:*:*:*:*:*:*",
                  "matchCriteriaId": "5C4EDC18-FBD1-473C-82F8-940097CE8C1C",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. \u00a0On successful exploitation, the attacker can read or modify the system data as well as shut down the system.\n\n"
        }
      ],
      "id": "CVE-2023-36922",
      "lastModified": "2024-11-21T08:10:55.903",
      "metrics": {
        "cvssMetricV31": [
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 9.1,
              "baseSeverity": "CRITICAL",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "HIGH",
              "scope": "CHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.3,
            "impactScore": 6.0,
            "source": "cna@sap.com",
            "type": "Secondary"
          },
          {
            "cvssData": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            },
            "exploitabilityScore": 2.8,
            "impactScore": 5.9,
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      },
      "published": "2023-07-11T03:15:10.357",
      "references": [
        {
          "source": "cna@sap.com",
          "tags": [
            "Permissions Required"
          ],
          "url": "https://me.sap.com/notes/3350297"
        },
        {
          "source": "cna@sap.com",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Permissions Required"
          ],
          "url": "https://me.sap.com/notes/3350297"
        },
        {
          "source": "af854a3a-2127-422b-91ae-364da2661108",
          "tags": [
            "Vendor Advisory"
          ],
          "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
        }
      ],
      "sourceIdentifier": "cna@sap.com",
      "vulnStatus": "Modified",
      "weaknesses": [
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-78"
            }
          ],
          "source": "cna@sap.com",
          "type": "Secondary"
        },
        {
          "description": [
            {
              "lang": "en",
              "value": "CWE-78"
            }
          ],
          "source": "nvd@nist.gov",
          "type": "Primary"
        }
      ]
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "SAP ECC and SAP S/4HANA (IS-OIL)",
                "vendor": "SAP_SE",
                "versions": [
                  {
                    "status": "affected",
                    "version": "IS-OIL 600"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 602"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 603"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 604"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 605"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 606"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 617"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 618"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 800"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 802"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 803"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 804"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 805"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 806"
                  },
                  {
                    "status": "affected",
                    "version": "IS-OIL 807"
                  }
                ]
              }
            ],
            "source": "cna@sap.com"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:600:*:*:*:*:*:*:*",
                    "matchCriteriaId": "BDC771C8-70C7-4EA4-BF13-9153175F652F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:602:*:*:*:*:*:*:*",
                    "matchCriteriaId": "D95174DD-6513-469F-911D-61FEF490BF44",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:603:*:*:*:*:*:*:*",
                    "matchCriteriaId": "A78F0A5A-514B-49C6-82E1-788049D4624A",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:604:*:*:*:*:*:*:*",
                    "matchCriteriaId": "92CF95AB-7222-4BB9-A01B-CC9BB0548DBE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:605:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8941EEEA-F588-419D-A72C-177A669D450B",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:606:*:*:*:*:*:*:*",
                    "matchCriteriaId": "94616B3E-ADE0-45E2-A3B8-B545E7E0BB0F",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:617:*:*:*:*:*:*:*",
                    "matchCriteriaId": "345E8B05-AE80-401D-895D-918136E5D738",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:618:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6B5038E3-5515-41C5-8C89-D839D5AE60DF",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:800:*:*:*:*:*:*:*",
                    "matchCriteriaId": "4BE09533-102E-492F-ACAE-5B959885EE45",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:802:*:*:*:*:*:*:*",
                    "matchCriteriaId": "70FA0AC8-D377-4800-9365-2EAD15C108C9",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:803:*:*:*:*:*:*:*",
                    "matchCriteriaId": "364A7BFE-3EAE-4897-B198-BEE1DCEB2163",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:804:*:*:*:*:*:*:*",
                    "matchCriteriaId": "2A119858-00D2-44CA-9C9D-9BEAFC8BD3CD",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:805:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5781D666-9439-4D4D-A0F6-DDA6763439CE",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:806:*:*:*:*:*:*:*",
                    "matchCriteriaId": "19188AD7-2B5F-48E9-81B2-30A60F009432",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:a:sap:netweaver:807:*:*:*:*:*:*:*",
                    "matchCriteriaId": "5C4EDC18-FBD1-473C-82F8-940097CE8C1C",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. \u00a0On successful exploitation, the attacker can read or modify the system data as well as shut down the system.\n\n"
          }
        ],
        "id": "CVE-2023-36922",
        "lastModified": "2026-06-17T06:07:23.157",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.1,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "HIGH",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.3,
              "impactScore": 6.0,
              "source": "cna@sap.com",
              "type": "Secondary"
            },
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.8,
              "impactScore": 5.9,
              "source": "nvd@nist.gov",
              "type": "Primary"
            }
          ]
        },
        "published": "2023-07-11T03:15:10.357",
        "references": [
          {
            "source": "cna@sap.com",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://me.sap.com/notes/3350297"
          },
          {
            "source": "cna@sap.com",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Permissions Required"
            ],
            "url": "https://me.sap.com/notes/3350297"
          },
          {
            "source": "af854a3a-2127-422b-91ae-364da2661108",
            "tags": [
              "Vendor Advisory"
            ],
            "url": "https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"
          }
        ],
        "sourceIdentifier": "cna@sap.com",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "cna@sap.com",
            "type": "Secondary"
          },
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-78"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "current_release_date": "2025-05-28T22:50:10+00:00",
      "cve": "CVE-2023-36922",
      "id": "CVE-2023-36922",
      "initial_release_date": "2023-01-01T00:00:00+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-36922.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.