Log Injection vulnerability in SAP ERP Defense Forces and Public Security (SAP_SE SAP ERP Defense Forces and Public Security)
En bref
- Source
- NVD
- EPSS
- EPSS 0.47 % · centile 41 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- sap
- Statut NVD
- Modified
Description
While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.
Faiblesses (CWE)
- CWE-117 — Neutralisation incorrecte des sorties de journalisation
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | sap |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | NVD · cna@sap.com (Secondary) |
| CVSS 3.1 | MEDIUM 4.9 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2023-40844
- GCVE · GCVE-0-2023-36924
Avis du CERT-FR
- CERTFR-2023-AVI-0531 — Multiples vulnérabilités dans les produits SAP · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:sap:erp_defense_forces_and_public_security:600:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:603:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:604:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:605:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:616:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:617:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:618:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:802:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:803:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:804:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:805:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:806:*:*:*:*:*:*:*cpe:2.3:a:sap:erp_defense_forces_and_public_security:807:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| SAP_SE · SAP ERP Defense Forces and Public Security | affected 600 ; affected 603 ; affected 604 ; affected 605 ; affected 616 ; affected 617 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |