SAP security note 2406841, "Java Script Engine of ABAP server may become unavailable", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The Java Script Engine of an ABAP server may become unavailable for a single user.
Solution
The solution improves the initialization of Java Script execution. Please implement the Patch Level of the Kernel mentioned in this SAP Note.
Reason and prerequisites
Prerequisite: A developer user is required. This user may create an incorrect Java Script and pass it to the Java Script Engine used in the SAP Kernel. The incorrect Java Script may cause the work process of the user to be terminated.
CVSS
Score 2.7 Vector: AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Affected components
- KRNL32NUC: 7.21, 7.21EXT
- KRNL32UC: 7.21, 7.21EXT
- KRNL64NUC: 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49
- KRNL64UC: 7.21, 7.21EXT, 7.22, 7.22EXT, 7.49
- KERNEL: 7.21 to 7.22, 7.45, 7.49
Full note on SAP: SAP Support Launchpad note 2406841
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
