Description
In the “common” module, the functionality of downloading or opening an attached file can be exploited by an attacker, allowing the attacker to modify application content, persist the modified content without authorization, and to potentially obtain authentication information from other legitimate users.
Available fix and Supported packages
- SAP-WEC | 1.0 | 1.0
- SAP-WEC | 2.0 | 2.0
- SAP-WEC | 3.0 | 3.0
- WEB CHANNEL 1.0 | SP001 | 000030
- WEB CHANNEL 2.0 | SP000 | 000026
- WEB CHANNEL 3.0 | SP000 | 000011
- WEB CHANNEL FRAMEWORK 1.0 | SP001 | 000030
- WEB CHANNEL FRAMEWORK 2.0 | SP000 | 000026
Affected component
- WEC-APP-BF
Web Channel: Cross-application functions
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1866659
