FM MD_SINGLE_ROUNDING should be RFC enabled and necessary authorization check done., SAP security note 2502878

SAP Note 2502878

SAP security note 2502878, "FM MD_SINGLE_ROUNDING should be RFC enabled and necessary authorization check done.". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Dump in calling application which calls FM MD_SINGLE_ROUNDING in RFC.

Solution

Implement the source code correction.

Reason and prerequisites

FM MD_SINGLE_ROUNNING was defined as a normal function module instead of an RFC module.

CVSS

Score 0

References

Referenced by

2487149 – Project Springfield: Functional Issue – IS-R-Purchasing

Affected components

SAP_APPL 600 to 618
SAPSCORE 110
S4CORE 100 to 102

Full note on SAP: SAP Support Launchpad note 2502878

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#MD_SINGLE_ROUNING #RFC #2487149

Explore More

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.

SAP Note 3758900: Code Injection in SAP MII (CVE-2026-44758)

August 11, 2026

CVE-2026-44758, CVSS 9.1: the SAP MII IllumXSLTServlet compiled a caller supplied stylesheet. SAP removed the endpoint rather than patching it.

SAP Note 3759854: Directory Traversal in SAP MII (CVE-2026-44763)

August 11, 2026

CVE-2026-44763, CVSS 7.6: a save path in the SAP MII SSCE interface was assembled without containment, letting files land outside the intended folder.

SAP Note 3758657: Scheduling Authorization Gap, SAP MII (CVE-2026-44765)

August 11, 2026

CVE-2026-44765, CVSS 7.3: SAP MII scheduling functions were reachable without an authorization check. The fix adds guards and new role assignments.