SAP security note 1492914, "Missing Virus Scan During Report Import". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability in the Environment, Health, and Safety (EH&S) application allows users to import reports containing files or documents in various formats (e.g., RTF, DOC, PDF) without performing a virus scan. This could enable the importation of infected documents, potentially compromising the system’s security.
Solution
Apply the correction instructions provided in this note. Before implementation, ensure to read and apply Note 1492505, which is a prerequisite.
CVSS
Score 0
References
- 1772637 – Virus scan for WWI documents
- 1492505 – Virus scan for WWI documents
- 786179 – Data security products: Use in the antivirus area
Affected components
- EA-APPL 110
- EA-APPL 200
- EA-APPL 500
- EA-APPL 600
- EA-APPL 602
- EA-APPL 603
- EA-APPL 604
- EA-APPL 605
Full note on SAP: SAP Support Launchpad note 1492914
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].