Description
An authenticated user can use functions of dbpool to which access should be restricted. This may result in an escalation of privileges.
UPDATE 14th May 2019 : This note contains partial fix. Please implement note 2664504 for complete fix. If you have not implemented this note, then implement only 2664504. Additionally, CVSS information is also made available.
Available fix and Supported packages
- SAP-JEE | 6.40 | 6.40
- SAP-JEECOR | 7.00 | 7.00
- SAP-JEECOR | 6.40 | 6.40
- SAP-JEECOR | 7.01 | 7.02
- SERVERCORE | 7.10 | 7.10
- SERVERCORE | 7.11 | 7.11
- SERVERCORE | 7.20 | 7.20
- SERVERCORE | 7.30 | 7.30
- SERVERCORE | 7.31 | 7.31
- SERVERCORE | 7.40 | 7.40
- J2EE ENGINE SERVERCORE 7.10 | SP012 | 000025
- J2EE ENGINE SERVERCORE 7.10 | SP013 | 000016
- J2EE ENGINE SERVERCORE 7.10 | SP014 | 000019
- J2EE ENGINE SERVERCORE 7.10 | SP015 | 000002
- J2EE ENGINE SERVERCORE 7.10 | SP016 | 000000
- J2EE ENGINE SERVERCORE 7.11 | SP007 | 000024
- J2EE ENGINE SERVERCORE 7.11 | SP008 | 000020
- J2EE ENGINE SERVERCORE 7.11 | SP009 | 000020
- J2EE ENGINE SERVERCORE 7.11 | SP010 | 000003
- J2EE ENGINE SERVERCORE 7.11 | SP011 | 000000
- J2EE ENGINE SERVERCORE 7.20 | SP005 | 000038
- J2EE ENGINE SERVERCORE 7.20 | SP006 | 000027
- J2EE ENGINE SERVERCORE 7.20 | SP007 | 000022
- J2EE ENGINE SERVERCORE 7.20 | SP008 | 000001
- J2EE ENGINE SERVERCORE 7.20 | SP009 | 000000
- J2EE ENGINE SERVERCORE 7.30 | SP002 | 000029
- J2EE ENGINE SERVERCORE 7.30 | SP003 | 000029
- J2EE ENGINE SERVERCORE 7.30 | SP004 | 000025
- J2EE ENGINE SERVERCORE 7.30 | SP005 | 000037
- J2EE ENGINE SERVERCORE 7.30 | SP007 | 000022
Affected component
- BC-JAS-TRH
Transactions and Resource Handling
CVSS
Score: 4.7
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1715734
