Log Injection vulnerability in SAP ERP Defense Forces and Public Security (SAP_SE SAP ERP Defense Forces and Public Security)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.47 % · percentile 41 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- sap
- NVD status
- Modified
Description
While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.
Weaknesses (CWE)
- CWE-117 — Improper Output Neutralization for Logs
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | sap |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2023-40844
- GCVE · GCVE-0-2023-36924
CERT-FR advisories
- CERTFR-2023-AVI-0531 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:sap:erp_defense_forces_and_public_security:600:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:603:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:604:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:605:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:616:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:617:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:618:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:802:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:803:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:804:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:805:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:806:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:807:*:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| SAP_SE · SAP ERP Defense Forces and Public Security | affected 600 ; affected 603 ; affected 604 ; affected 605 ; affected 616 ; affected 617 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |