Skip links
🔥🔥🔥 Join us for our upcoming training session at Black Hat MEA: "Securing SAP Systems: Expert Insights and Penetration Testing Techniques" 🛡️🔍

Potential modif. or disclosure of persisted data in WFM, SAP security note 1638596

Description

An attacker can exploit WFM (Workforce Management) and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information, or the modification of data persisted by the system.
The following function modules are concerned:

  • WFACS_CALCSTATUSES_GET
  • WFATM_CLEAN_TEMP_TABLES
  • WFA_DATE_DEP_ADD
  • WFA_DATE_DEP_ADD_HISTORY
  • WFA_DATE_DEP_PARENT_ADD
  • WFA_TEXT_MODIFY

Available fix and Supported packages

  • RTLWFM | 100 | 100
  • RTLWFM | 310 | 310
  • RTLWFM 310 | SAPK-31010INRTLWFM |
  • RTLWFM 100 | SAPK-10015INRTLWFM |

Affected component

    CA-GTF-WFA
    please use CRM-WFD(Workforce Management Application)

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1638596

TAGS

#SQL-injection
#database
#WFM

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer