Missing whitelist check in XX-CSC-RU-FI, SAP security note 1933777

Description

An authenticated user can use functions of XX-CSC-RU-FI to which access should be restricted. This may result in an escalation of privileges.

Available fix and Supported packages

SAP_APPL | 616 | 616
SAP_APPL | 617 | 617
SAP_APPL 616 | SAPKH61605 |
SAP_APPL 617 | SAPKH61703 |

Affected component

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1933777

TAGS

#Whitelist
#whitelist-check
#&160-XX-CSC-RU-FI

More to explorer

[PoC] SAP PING PONG – XSS and URL Redirection Vulnerabilities

October 22, 2024

Recently, SAP released a security update for SAP NetWeaver AS for ABAP and ABAP Platform, addressing multiple vulnerabilities related to cross-site scripting

[PoC] SAP Note 3433192 – Code Injection vulnerability in SAP NetWeaver AS Java

October 17, 2024

Overview Recently, SAP released Security Note 3433192, which addresses a critical code injection vulnerability (CVE-2024-22127) within the SAP NetWeaver AS Java Administrator

CVE-2024-37180 – Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

October 8, 2024

Release Date: October 8, 2024SAP Security Note: 3454858Component: SAP NetWeaver Application Server for ABAP and ABAP PlatformPriority: MediumCategory: Information DisclosureCVE Identifier: CVE-2024-37180

CVE-2024-47594 – Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver Enterprise Portal (KMC)