CVE-2023-36924 - CVE House
Back to Database
Status published Medium CVE-2023-36924

Log Injection vulnerability in SAP ERP Defense Forces and Public Security

Vulnerability Description

While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-36924

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP_SE

View All →
CVE-2025-43011
Missing Authorization Check in SAP Landscape Transformation (PCL Basis)
High 7.7
CVE-2025-43010
Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))
High 8.3
CVE-2025-43009
Missing Authorization check in SAP Service Parts Management (SPM)
Medium 6.3
CVE-2025-43008
Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
Medium 5.8
CVE-2025-43007
Missing Authorization check in SAP Service Parts Management (SPM)
Medium 6.3

Affected Vendor

Affected Software

SAP ERP Defense Forces and Public Security
Vulnerable Versions:
600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807

Timeline

Official Publish: July 11th, 2023
Last Modified: October 23rd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Weaknesses (CWE)

CWE-117

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.