Description
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful exploitation, the attacker can read or modify the system data as well as shut down the system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| SAP_SE | SAP ECC and SAP S/4HANA (IS-OIL) | IS-OIL 600, IS-OIL 602, IS-OIL 603, IS-OIL 604, IS-OIL 605, IS-OIL 606, IS-OIL 617, IS-OIL 618, IS-OIL 800, IS-OIL 802, IS-OIL 803, IS-OIL 804, IS-OIL 805, IS-OIL 806, IS-OIL 807 | — |
Advisories 3
- WID-SEC-2023-3103 SAP Software: Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 11, 2023
- WID-SEC-2023-1980 SAP Patchday August 2023 BSI CERT-Bund (WID) · Aug 7, 2023
- WID-SEC-2023-1705 SAP Patchday Juli 2023 BSI CERT-Bund (WID) · Jul 10, 2023