CVE-2023-36924

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-36924
While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.

4.9 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://me.sap.com/notes/3351410 Permissions Required
https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:erp_defense_forces_and_public_security:600:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:603:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:604:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:605:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:616:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:617:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:618:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:802:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:803:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:804:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:805:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:806:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:807:*:*:*:*:*:*:*
History

19 Jul 2023, 18:29

Type Values Removed Values Added
CPE cpe:2.3:a:sap:erp_defense_forces_and_public_security:616:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:802:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:803:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:805:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:618:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:617:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:804:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:806:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:600:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:807:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:604:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:605:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:603:*:*:*:*:*:*:*
References (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - (MISC) https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html - Vendor Advisory
References (MISC) https://me.sap.com/notes/3351410 - (MISC) https://me.sap.com/notes/3351410 - Permissions Required
First Time Sap erp Defense Forces And Public Security
Sap
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.9

11 Jul 2023, 03:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-07-11 03:15

Updated : 2023-12-10 15:01

NVD link : CVE-2023-36924

Mitre link : CVE-2023-36924

CVE.ORG link : CVE-2023-36924

JSON object : View

Products Affected

sap

  • erp_defense_forces_and_public_security
CWE
CWE-117

Improper Output Neutralization for Logs