Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Security Note Automatic execution of BPM task attachments, SAP security note 1433736

Description

Certain types of attachments to BPM tasks and processes are recognized by the browser and automatically executed upon download, e.g. javascript files. This creates a potential risk of executing malicious active content. Since BPM as a platform is not intended for use with open user goups (i.e. anonymous users) the risk is rated low.

Available fix and Supported packages

  • BPEM-WDUI | 7.11 | 7.11

Affected component

    BC-BMT-BPM-DSK
    Process Desk

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1433736

TAGS

#Galaxy
#SAP-NW-BPM
#Business-Process-Management
#attachments

Explore More

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.