SAP Note 1758450
SAP Security Note
Medium priority
SAP Security Note
Medium priority
SAP security note 1758450, "Code injection vulnerability in CCMS Agent", is a program error note released on 13.11.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
CCMS Agent contains code that permits the execution of arbitrary program code of the user's choice. An attacker can therefore control the behavior of the system or potentially escalate privileges by executing malicious code without having their own legitimate credentials.
Solution
Update CCMS Agents with the new ccmagent.sar.
CVSS
Score 3.5 Vector: AV:L/AC:H/AU:S/C:P/I:P/A:P
References
Full note on SAP: SAP Support Launchpad note 1758450
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].