Update 1 to 1906212 Code injection vulnerability in Knowledge Provider., SAP security note 2278931

SAP Note 2278931 Medium priority

SAP security note 2278931, "Update 1 to 1906212: Code injection vulnerability in Knowledge Provider.", was released on January 9, 2018. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Basis Services/Communication Interfaces > Knowledge Provider > Document Management Services (BC-SRV-KPR-DMS)

PriorityMedium priority

Version7

StatusReleased for Customer

Released onJanuary 9, 2018

LanguageEnglish

Description

Symptom

This security note addresses a code injection vulnerability in the BC-SRV-KPR-DMS component of SAP. The vulnerability allows a malicious user to execute arbitrary program code, potentially controlling system behavior or escalating privileges without legitimate credentials.

Solution

Implement this SAP Note or upgrade to the relevant Support Packages listed below. For a complete fix, also implement SAP Note 2525392.

CVSS

Score 6.5 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

References

This note refers to

1906212 – Code Injection vulnerability in Knowledge Provider.

Referenced by

2525392 – [CVE-2018-2363] Update 2 to 1906212: Code injection vulnerability in Knowledge Provider.

Full note on SAP: SAP Support Launchpad note 2278931

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Document Management Services #Knowledge Provider #BC-SRV-KPR-DMS #Code Injection