Report RJ-J3INI generates source code unnecessarily, SAP security note 1490182

SAP security note 1490182, "Report RJ-J3INI generates source code unnecessarily". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

IS-M contains ABAP source code. This enables malicious users to inject and run their own code.

Solution

Implement this note or import the relevant Support Package.

Reason and prerequisites

The program contains statements that enable the user to execute user-defined code that changes the behavior of the system. A valid and authenticated user is required for this.

Depending on the code that the user injects, the user can obtain additional information that should not be displayed. In addition, the user may modify data, delete data, modify the output of the system, or create new users with higher privileges. There is also the risk that the system may no longer be available.

CVSS

Score 0

References

• 1361038 – Report RJ-JXINI generates unnecessary source code

Affected components

• IS-M 464
• IS-M 471
• IS-M 472
• IS-M 600
• IS-M 602
• IS-M 603
• IS-M 604
• IS-M 605