Summary:
The top-priority security note addresses an OS command injection vulnerability in SAP ECC and S/4HANA (IS-OIL). The highest-priority vulnerability tracked as CVE-2023-36922 and has a CVSS score of 9.1. This vulnerability enables an authenticated attacker to inject arbitrary operating system commands into an unprotected parameter of a vulnerable transaction and program. Successful exploitation of this flaw could compromise the confidentiality, integrity, and availability of the targeted system, potentially leading to unauthorized data access or manipulation.[/subscribe_to_unlock_form]
Summary:
The top-priority security note addresses an OS command injection vulnerability in SAP ECC and S/4HANA (IS-OIL). The highest-priority vulnerability tracked as CVE-2023-36922 and has a CVSS score of 9.1. This vulnerability enables an authenticated attacker to inject arbitrary operating system commands into an unprotected parameter of a vulnerable transaction and program. Successful exploitation of this flaw could compromise the confidentiality, integrity, and availability of the targeted system, potentially leading to unauthorized data access or manipulation.[emaillocker id="1283"]
The recently disclosed SAP security vulnerabilities pose significant risks to organizations using SAP ECC, S/4HANA (IS-OIL), and SAP Business Client. The potential consequences of these vulnerabilities include unauthorized access, data manipulation, and service disruption. To mitigate these risks, SAP has issued critical security notes containing patches for the identified vulnerabilities. Organizations are strongly advised to apply the available patches as soon as possible.
Recommendations:
We strongly recommend you apply the patch from the given security note.
References:
The following reports contain further technical details:
https://www.securityweek.com/sap-patches-critical-vulnerability-in-ecc-and-s-4hana-products/
[/emaillocker]