Code injection vulnerability in LSO_WIZ4_TEXT_VARIABLES, SAP security note 1600755

SAP security note 1600755, "Code injection vulnerability in LSO_WIZ4_TEXT_VARIABLES". Below are the symptom and SAP recommended solution.

Description

Symptom

HRLOS00_WIZ4 contains code that permits the execution of arbitrary program code of the user’s choice. A malicious user can control the behavior of the system or potentially escalate privileges by executing malicious code without having legitimate credentials.

Solution

Apply the correction instructions in the note or upgrade to the relevant support package to resolve this vulnerability.

Reason and prerequisites

The program code allows defining and executing user-defined code that changes the behavior of the system. A valid and authenticated user is required. Translation authorizations are necessary to execute the injected code.

Depending on the code, the user can:

• Inject and run their own code.
• Modify or delete data.

CVSS

Score 6.1 Vector: AV:N/AC:H/AU:S/C:P/I:P/A:C

References

• SAP Note 888889: Automatic checks for security notes using RSECNOTE (outdated)