How severe is CVE-2023-36924?

CVE-2023-36924 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.

Is CVE-2023-36924 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-36924?

CVE-2023-36924 primarily affects Sap Erp Defense Forces And Public Security. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.

How do I fix CVE-2023-36924?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

When was CVE-2023-36924 published?

CVE-2023-36924 was published on 2023-07-11 and last updated on 2026-06-17.

CVE-2023-36924

CVE-2023-36924 is a medium-severity vulnerability in Sap Erp Defense Forces And Public Security with a CVSS 3.x base score of 4.9. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-117.

Key facts

Severity: Medium (CVSS 3.x base score 4.9)
EPSS exploit prediction: 0% (31st percentile)
Actively exploited: Not listed in CISA KEV
Weakness: CWE-117
Affected product: Sap Erp Defense Forces And Public Security
Published: 2023-07-11
Last modified: 2026-06-17

Description

While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.

Frequently asked questions

What is CVE-2023-36924?: While using a specific function, SAP ERP Defense Forces and Public Security - versions 600, 603, 604, 605, 616, 617, 618, 802, 803, 804, 805, 806, 807, allows an authenticated attacker with admin privileges to write arbitrary data to the syslog file. On successful exploitation, an attacker could modify all the syslog data causing a complete compromise of integrity of the application.
How severe is CVE-2023-36924?: CVE-2023-36924 has a CVSS 3.x base score of 4.9, rated medium severity. It is exploitable over network with low attack complexity, requires high privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
Is CVE-2023-36924 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (31st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-36924?: CVE-2023-36924 primarily affects Sap Erp Defense Forces And Public Security. In total, 13 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
How do I fix CVE-2023-36924?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
When was CVE-2023-36924 published?: CVE-2023-36924 was published on 2023-07-11 and last updated on 2026-06-17.

References

Affected products (13)

cpe:2.3:a:sap:erp_defense_forces_and_public_security:600:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:603:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:604:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:605:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:616:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:617:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:618:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:802:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:803:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:804:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:805:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:806:*:*:*:*:*:*:*
cpe:2.3:a:sap:erp_defense_forces_and_public_security:807:*:*:*:*:*:*:*

Other CWE-117 (Improper Output Neutralization for Logs) vulnerabilities

CVE-2023-46322 — Critical (CVSS 9.8): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. The hostname's initial…
CVE-2023-46321 — Critical (CVSS 9.8): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. They may have shell…
CVE-2024-0095 — Critical (CVSS 9.0): NVIDIA Triton Inference Server for Linux and Windows contains a vulnerability where a user can inject forged logs and…
CVE-2024-25047 — High (CVSS 8.6): IBM Cognos Analytics 11.2.0 through 11.2.4 and 12.0.0 through 12.0.2 is vulnerable to injection attacks in application…
CVE-2025-57564 — High (CVSS 8.2): CubeAPM nightly-2025-08-01-1 allow unauthenticated attackers to inject arbitrary log entries into production systems…
CVE-2026-10745 — High (CVSS 7.9): Improper output neutralization for logs vulnerability in upKeeper Solutions upKeeper Instant Privilege Access on…

Browse all CWE-117 (Improper Output Neutralization for Logs) vulnerabilities →