Code injection vulnerability in BW-WHM-DST, SAP security note 1849559

SAP security note 1849559, "Code Injection Vulnerability in BW-WHM-DST". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The BW-WHM-DST component contains code that permits the execution of arbitrary program code chosen by the user. An attacker can leverage this vulnerability to control system behavior or escalate privileges by executing malicious code without having legitimate credentials.

Solution

To remediate this vulnerability, apply the relevant Support Packages based on your SAP NetWeaver BW version:

• SAP NetWeaver BW 7.00: Import Support Package 31 (SAPKW70031)
• SAP NetWeaver BW 7.01: Import Support Package 14 (SAPKW70114)
• SAP NetWeaver BW 7.02: Import Support Package 14 (SAPKW70214)
• SAP NetWeaver BW 7.11: Import Support Package 12 (SAPKW71112)
• SAP NetWeaver BW 7.30: Import Support Package 10 (SAPKW73010)
• SAP NetWeaver BW 7.31: Import Support Package 9 (SAPKW73109)
• SAP NetWeaver BW 7.40: Import Support Package 3 (SAPKW74003)

Reason and prerequisites

Successful exploitation can lead to:

• Injection and execution of unauthorized code.
• Access to additional sensitive information.
• Modification or deletion of data.
• Creation of new users with higher privileges.
• Denial of service attacks.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

Affected components

• SAP NetWeaver BW 7.00
• SAP NetWeaver BW 7.01
• SAP NetWeaver BW 7.02
• SAP NetWeaver BW 7.11
• SAP NetWeaver BW 7.30
• SAP NetWeaver BW 7.31
• SAP NetWeaver BW 7.40
• SAP BW Virtual Component 7.01