SAP Security Note
High priority
SAP security note 1909858, "Missing whitelist check in CA-GTF-WFM", is a program error note released on December 10, 2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An authenticated user can use functions of CA-GTF-WFM to which access should be restricted. This may result in an escalation of privileges.
Solution
Implement the following correction instructions.
Reason and prerequisites
CA-GTF-WFM does not contain required checks against a positive set of allowed functions (i.e., whitelist) during the execution of these functions. This is necessary to verify that authenticated users are permitted to access these functions. The absence of this check may lead to undesired system behavior.
CVSS
Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P
Affected components
- WFMCORE 200
Full note on SAP: SAP Support Launchpad note 1909858
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
