Description
In Web Dynpro-based InfoObject master data maintenance, as well as in Web Dynpro-based hierarchy maintenance, there is an option to download the table data. When you do so, the data is transferred to a CSV file as defined in the table.
If the table contains values that can be interpreted as commands in MS Excel and the file is opened in MS Excel, these commands may be executed directly as soon as the file is opened.
Available fix and Supported packages
- DW4CORE | 100 | 100
- SAP_BW | 740 | 740
- SAP_BW | 750 | 752
- DW4CORE 100 | SAPK-10007INDW4CORE |
- SAP_BW 752 | SAPK-75201INSAPBW |
- SAP_BW 740 | SAPKW74019 |
- SAP_BW 750 | SAPK-75011INSAPBW |
Affected component
- BW-WHM-DBA-MD
Master Data
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2545530
