Description
This security note has been updated. For more detailed information, see Security Note 1618255.
SRM basis objects contains code which allows to execute arbitrary program code of the user’s choice.
A malicious user can therefore control the behavior of the system or can potentially escalate privileges by executing malicious code without legitimate own credentials.
Affected Releases:
- SAP SRM 4.0
- SAP SRM 5.0
- SAP SRM 6.0
- SAP SRM 7.0
- SAP SMR 7.01
Available fix and Supported packages
- SRM_SERVER | 500 | 500
- SRM_PLUS | 550 | 550
- SRM_PLUS | 600 | 600
- SRM_PLUS | 700 | 700
- SRM_PLUS | 701 | 701
- SRM_SERVER 500 | SAPKIBKS17 |
- SRM_PLUS 600 | SAPKIBK106 |
- SRM_PLUS 701 | SAPK-70102INSRMPLUS |
- SRM_PLUS 550 | SAPKIBK018 |
- SRM_PLUS 700 | SAPKIBK210 |
- SRM_PLUS 701 | SAPK-70103INSRMPLUS |
Affected component
- SRM-EBP-TEC-MW
Middleware
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1506970
