CVE-2023-36922 (published 2023-07-11T02:56:55.299Z)
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension.  On successful exploitation, the attacker can read or modify the system data as well as shut down the system.


Affected products: Vendor: SAP_SE
Product: SAP ECC and SAP S/4HANA (IS-OIL)
Versions: IS-OIL 600, IS-OIL 602, IS-OIL 603, IS-OIL 604, IS-OIL 605, IS-OIL 606, IS-OIL 617, IS-OIL 618, IS-OIL 800, IS-OIL 802, IS-OIL 803, IS-OIL 804, IS-OIL 805, IS-OIL 806, IS-OIL 807