Description
C-CEE add-on contain user-driven dynamic procedure calls that permit the execution of arbitrary program code of the user’s choice.
An attacker can therefore control the behavior of the system, or can potentially escalate privileges by executing malicious code, without having their own legitimate credentials
An attacker can be authenticated to affected reports without having their own legitimate credentials, or they may escalate privileges.
Available fix and Supported packages
- C-CEE | 110_600 | 110_600
- C-CEE | 110_602 | 110_602
- C-CEE | 110_603 | 110_603
- C-CEE | 110_604 | 110_604
- C-CEE 110_600 | SAPK-11039INCCEE |
- C-CEE 110_602 | SAPK-60225INCCEE |
- C-CEE 110_603 | SAPK-60325INCCEE |
- C-CEE 110_604 | SAPK-60423INCCEE |
Affected component
- XX-CSC-BG-FI
Financial Accounting
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2024315
