Vahagn Vardanian

Co-founder and CTO of RedRays

December 17, 2009
9:44 am

Security Checks Removal of hardcoded user names, SAP security note 1334396

SAP Note 1334396
SAP Security Note
Medium priority

SAP security note 1334396, "Security Checks: Removal of hardcoded user names", is a program error note released on December 17, 2009. Below are the symptom, SAP recommended solution and the affected software components.

ComponentSupply Chain Management > Advanced Planning and Optimization > Production Planning and Detailed Scheduling

CategoryProgram error

PriorityMedium priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released onDecember 17, 2009

LanguageEnglish

Description

Symptom

Security Checks: Removal of hardcoded user names.

Solution

Implement the source code changes.

Reason and prerequisites

This problem is caused by a program error.

References

This note refers to

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Referenced by

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

SAP_APO: 30A
SAP_APO: 310
SCM: 400
SCM: 410
SCM: 500
SCM: 510
SCM: 700

CVSS

Score 0

Full note on SAP: SAP Support Launchpad note 1334396

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Sy-uname #Security Checks

Explore More

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.

SAP Note 3758900: Code Injection in SAP MII (CVE-2026-44758)

August 11, 2026

CVE-2026-44758, CVSS 9.1: the SAP MII IllumXSLTServlet compiled a caller supplied stylesheet. SAP removed the endpoint rather than patching it.

SAP Note 3759854: Directory Traversal in SAP MII (CVE-2026-44763)

August 11, 2026

CVE-2026-44763, CVSS 7.6: a save path in the SAP MII SSCE interface was assembled without containment, letting files land outside the intended folder.

SAP Note 3758657: Scheduling Authorization Gap, SAP MII (CVE-2026-44765)

August 11, 2026

CVE-2026-44765, CVSS 7.3: SAP MII scheduling functions were reachable without an authorization check. The fix adds guards and new role assignments.