Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Integrated generic callpoint/Treasury & Risk Mgmt.2A, SAP security note 1563017

SAP Note 1563017
SAP Security Note
HotNews

SAP security note 1563017, "Integrated generic callpoint/Treasury & Risk Mgmt.2A", is a program error note released on September 13, 2011. Below are the symptom and SAP recommended solution.

ComponentFIN-FSCM-TRM (Financials > Financial Supply Chain Management > Treasury and Risk Management)
CategoryProgram error
PriorityHotNews
TypeSAP Security Note
Version3
StatusReleased for Customer
Released onSeptember 13, 2011

Description

Symptom

A hard-coded, generic callpoint for function modules in Treasury and Risk Management allows a malicious user to remotely call functions not intended for such access, potentially executing malicious code.

Solution

Implement the attached correction instructions for your release.

Reason and prerequisites

The program code contains a hard-coded, remote-enabled callpoint for function modules that are not intended for remote access.

CVSS

Score 7.5 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:C

References

Full note on SAP: SAP Support Launchpad note 1563017

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Treasury and Risk Management #generic function #FIN-FSCM-TRM

Explore More