Code injection vulnerability in SAP_BASIS, SAP security note 1714607

SAP security note 1714607, "Code injection vulnerability in SAP_BASIS", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

SAP_BASIS contains code that permits the execution of arbitrary program code of the user’s choice. An attacker can control the behavior of the system or potentially escalate privileges by executing malicious code without having legitimate credentials.

Solution

To address this vulnerability, you should:

• Use the SAP Note Assistant to implement the correction instructions.
• Import the relevant Support Package.

Reason and prerequisites

The program code allows the definition and execution of user-defined code that changes the system’s behavior. To exploit this vulnerability, the following prerequisites are required: a valid and authenticated user, and authorization for transaction SE37 to execute the injected code. Possible actions by an attacker include injecting and running their own code, modifying or deleting data, and altering the system’s output.

CVSS

Score 6.1 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:C