Description
This security note has been updated.
For more detailed information, see Security Note 1727640.
A malicious user can trigger functionalities in the Supplier Workplace services without authentication and authorization. The user can perform actions for which he has no authorization.
The following services can be affected and have now been protected.
1. ISA_SICKANBAN
2. ISA_SICALERT
3. ISAUTO_SICRPM
4. ISAUTO_SICBC
5. ISAUTO_SICASN1
6. ISAUTO_SICASN2
7. ISAUTO_SICASN3
8. ISAUTO_SICASN4
9. ISAUTO_SICCO
10.ISAUTO_SICENG
11.ISAUTO_SICDDL1
12. ISAUTO_SICENG
13. ISAUTO_SICJIT
14. ISAUTO_SICPDI
15. ISAUTO_SICPH
16. ISAUTO_SICPI
17. ISAUTO_SICRL
18. ISAUTO_SICRLRD
19. ISAUTO_SICRPM
20. ISIPI_CS
21. ISIPI_CP
22. ISIPI_ESP
23. ISIPI_OEPM
24. ISIPI_PUL
25. ISIPI_SUMJIT
26. ISIPI_TRACK
27. ISIPI_SM
28. ISIPI_POD
29. ISAUTO_SIC
30. ISIPI_CE
Available fix and Supported packages
- ECC-DIMP | 500 | 500
- ECC-DIMP | 600 | 600
- ECC-DIMP | 602 | 602
- ECC-DIMP | 603 | 603
- ECC-DIMP | 604 | 604
- ECC-DIMP | 605 | 605
- ECC-DIMP 600 | SAPK-60019INECCDIMP |
- ECC-DIMP 500 | SAPKIPMH14 |
- ECC-DIMP 602 | SAPK-60209INECCDIMP |
- ECC-DIMP 603 | SAPK-60308INECCDIMP |
- ECC-DIMP 604 | SAPK-60409INECCDIMP |
- ECC-DIMP 605 | SAPK-60503INECCDIMP |
- ECC-DIMP 605 | SAPK-60509INECCDIMP |
Affected component
- IS-A-SWP
Supplier Workplace
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1520101
