SAP security note 1604056, “Integrated generic callpoint/Treasury & Risk Mgmt.2B”. Below are the symptom and SAP recommended solution.
Description
Symptom
Hard-coded, generic callpoint for function modules in Treasury and Risk Management.
A malicious user can use a hard-coded, generic callpoint to remotely call up functions that are not intended to be accessed in this way and so execute malicious codes.
Solution
Implement the attached correction instructions for your release.
Reason and prerequisites
The program code contains a hard-coded, remote-enabled callpoint for function modules that are not intended for remote access.
CVSS
Score 7.5 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:C
Full note on SAP: SAP Support Launchpad note 1604056
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
