title: Log Injection vulnerability in SAP ERP Defense Forces and Public Security
description: While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.
problem types: CWE-117: Improper Output Neutralization for Logs
affected:
{
defaultStatus: unaffected
product: SAP ERP Defense Forces and Public Security
vendor: SAP_SE
versions:
status: affected, version: 600
status: affected, version: 603
status: affected, version: 604
status: affected, version: 605
status: affected, version: 616
status: affected, version: 617
status: affected, version: 618
status: affected, version: 802
status: affected, version: 803
status: affected, version: 804
status: affected, version: 805
status: affected, version: 806
status: affected, version: 807
}
metrics:
cvssV3_1: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 4.9
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: HIGH
privilegesRequired: HIGH
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
version: 3.1
]
format: CVSS
scenarios: GENERAL