Description
An attacker can exploit WFM (Workforce Management) and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information, or the modification of data persisted by the system.
The following function modules are concerned:
- WFACS_CALCSTATUSES_GET
- WFATM_CLEAN_TEMP_TABLES
- WFA_DATE_DEP_ADD
- WFA_DATE_DEP_ADD_HISTORY
- WFA_DATE_DEP_PARENT_ADD
- WFA_TEXT_MODIFY
Available fix and Supported packages
- RTLWFM | 100 | 100
- RTLWFM | 310 | 310
- RTLWFM 310 | SAPK-31010INRTLWFM |
- RTLWFM 100 | SAPK-10015INRTLWFM |
Affected component
- CA-GTF-WFA
please use CRM-WFD(Workforce Management Application)
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1638596
