Vulnerability · Published Jul 11, 2023 · Assigned by sap

CVE-2023-36924Log Injection vulnerability in SAP ERP Defense Forces and Public Security

Medium 4.9

In plain English

A medium-severity security flaw in SAP ERP Defense Forces and Public Security from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)4.9Medium

Exploit odds (30 days)0.5%top 58.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP ERP Defense Forces and Public Security	600603604605616617618802

Weakness: CWE-117 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

In plain English

Official description

Affected products (as reported)

References