Skip links

Security note Files transferrable to EPS inbox w/o auth., SAP security note 1330776

Description

Due to a missing authorization check in an RFC-enabled function module, if certain prerequisites are met, you can place files in the EPS inbox without authorization.

Available fix and Supported packages

  • SAP_BASIS | 46A | 46D
  • SAP_BASIS | 610 | 640
  • SAP_BASIS | 700 | 702
  • SAP_BASIS | 710 | 711
  • SAP_BASIS 620 | SAPKB62066 |
  • SAP_BASIS 711 | SAPKB71103 |
  • SAP_BASIS 640 | SAPKB64025 |
  • SAP_BASIS 701 | SAPKB70105 |
  • SAP_BASIS 700 | SAPKB70020 |
  • SAP_BASIS 710 | SAPKB71009 |
  • SAP_BASIS 46C | SAPKB46C59 |
  • SAP_BASIS 702 | SAPKB70203 |

Affected component

    BC-UPG-OCS
    Online Corr. Support (Tools:Supp.-Pack., Addon Install/Upgr)

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1330776

TAGS

#EPS
#SPAM
#Transport-Management-System
#TMS
#upgrade