Description
UPDATE 13th April 2021: This note has been re-released with updated ‘Correction instruction’ information.
UPDATE 26th January 2021: This note has been re-released with updated ‘Correction instruction’ information.
SAP Landscape Transformation allows a high privileged user to execute a RFC function module to which access should be restricted. This weakness gives attacker ability to read some sensitive internal information and also make vulnerable SAP systems completely unavailable.
Available fix and Supported packages
- DMIS | 2011_1_620 | 2011_1_620
- DMIS | 2011_1_640 | 2011_1_640
- DMIS | 2011_1_700 | 2011_1_700
- DMIS | 2011_1_710 | 2011_1_710
- DMIS | 2011_1_730 | 2011_1_730
- DMIS | 2011_1_731 | 2011_1_731
- DMIS | 2018_1_752 | 2018_1_752
- DMIS | 2020 | 2020
- S4CORE | 100 | 100
- S4CORE | 101 | 101
- S4CORE | 102 | 102
- S4CORE | 103 | 103
- S4CORE | 104 | 104
- S4CORE | 105 | 105
- DMIS 2018_1_752 | SAPK-20105INDMIS |
- DMIS 2011_1_620 | SAPK-11120INDMIS |
- DMIS 2011_1_640 | SAPK-11220INDMIS |
- DMIS 2011_1_710 | SAPK-11420INDMIS |
- DMIS 2011_1_730 | SAPK-11520INDMIS |
- DMIS 2011_1_731 | SAPK-11620INDMIS |
- DMIS 2011_1_700 | SAPK-11320INDMIS |
- DMIS 2020 | SAPK-20201INDMIS |
- S4CORE 105 | SAPK-10501INS4CORE |
- S4CORE 101 | SAPK-10110INS4CORE |
- S4CORE 102 | SAPK-10208INS4CORE |
- S4CORE 103 | SAPK-10306INS4CORE |
- S4CORE 104 | SAPK-10404INS4CORE |
- S4CORE 105 | SAPK-10502INS4CORE |
Affected component
- CA-DT-CNV
Landscape Transformation for Conversion
CVSS
Score: 7.6
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:H
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2993132
