Code injection vulnerability in SRM basis objects, SAP security note 1506970

SAP security note 1506970, "Code injection vulnerability in SRM basis objects". Below are the symptom and SAP recommended solution.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 1618255.

SRM basis objects contain code that allows executing arbitrary program code of the user’s choice. A malicious user can control system behavior or potentially escalate privileges by executing malicious code without legitimate credentials.

Affected releases:

• SAP SRM 4.0
• SAP SRM 5.0
• SAP SRM 6.0
• SAP SRM 7.0
• SAP SMR 7.01

Solution

Implement the automatic correction instructions of Security Note 1506970. This will deactivate the critical source code.

Alternatively, implement this note or import the related support package.

Reason and prerequisites

Program error.

References

• Security Note 1618255 – Update #1 to Security Note 1506970
• Security Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)