CDMC(ST-PI SP00-SP03)Potential disclosure of persisted data, SAP security note 1510828

SAP security note 1510828, "CDMC(ST-PI SP00-SP03): Potential disclosure of persisted data", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit CDMC (ST-PI Service Pack Level SP00-SP03) by using specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Solution

Implement SAP Security Note 1510828 to apply the necessary corrections. This note contains the required patches and instructions to mitigate the SQL injection vulnerability.

Reason and prerequisites

The vulnerability arises from the composition of SQL statements that include user-alterable strings. This allows the manipulation of SQL commands to access unauthorized data.

References

• Collective Note with all corrections for CDMC (ST-PI SP03)
• CDMC Corrections – Composite SAP Note

Affected components

• ST-PI SP00-SP03