Potential modification or disclosure of persisted data in .., SAP security note 1515372

SAP security note 1515372, “Potential modification or disclosure of persisted data in ..”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1606213. A malicious user can exploit ABAP Test Framework Checks and use specially crafted inputs to modify database commands, resulting in either the retrieval of additional information or modification of data persisted by the system.

Solution

Apply the correction or the respective support package.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional data from the database or modify it.

CVSS

Score 0

References

• Security Note 1606213 – Update #1 to Security Note 1515372

Affected components

• BC-DWB-TOO-ATF (Basis Components > ABAP Workbench, Java IDE and Infrastructure > Workbench Tools: Editors, Painter, Modeler > ABAP Check Frameworks – ABAP Test Cockpit, Code Inspector)
• SAP_BASIS 620 to 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730
• SAP_BASIS 72L to 800