Potential disclosure of persisted data in Schedule manager, SAP security note 1582141

SAP security note 1582141, "Potential disclosure of persisted data in Schedule manager". Below are the symptom and SAP recommended solution.

Description

Symptom

A security vulnerability has been identified in the Schedule Manager (CA-GTF-SCM) that allows a malicious user to perform SQL injection. This can lead to the disclosure of persisted data from the database.

A malicious user can exploit Schedule Manager and use specially crafted inputs to modify database commands, resulting in the retrieval of additional information persisted by the system.

Potential unauthorized access to sensitive data stored in the database.

Solution

To address this vulnerability, you should:

• Import the relevant support packages from the Support Package List.
• Implement the attached corrections available at Correction Instructions.

Affected components

• SAP_ABA versions 46C, 620, 640, 700-702, 710-711, 730