Cyber Resilience

CVE-2023-36924

Medium

Published: 11 July 2023

Published
11 July 2023
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 4.9 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0014 33.8th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-36924 is a medium-severity Improper Output Neutralization for Logs (CWE-117) vulnerability in Sap Erp Defense Forces And Public Security. Its CVSS base score is 4.9 (Medium).

Operationally, ranked at the 33.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the…

more

syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.

CWE(s)
CWE-117

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

sap
erp defense forces and public security
600, 603, 604, 605, 616

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AU-1 Policy and Procedures
addresses: CWE-117

Policy and procedures require sanitization and neutralization when generating audit logs to avoid injection issues.

SI-15 Information Output Filtering
addresses: CWE-117

Requiring output to conform to expected content prevents unneutralized data from reaching logs.

References