Skip links

Missing authentication step in PI, SAP security note 1557806

Description

A malicious user can use functions of PI to which access should be restricted. This may result in an escalation of privileges.

Available fix and Supported packages

  • SAP_XIESR | 7.10 | 7.11
  • SAP_XIESR | 7.30 | 7.30
  • SAP_XIESR | 7.31 | 7.31
  • SAP_XITOOL | 7.10 | 7.11
  • SAP_XITOOL | 7.30 | 7.30
  • SAP_XITOOL | 7.31 | 7.31
  • SAP_XIAF | 7.10 | 7.11
  • SAP_XIAF | 7.30 | 7.30
  • SAP_XIAF | 7.31 | 7.31
  • ESR 7.10 | SP008 | 000025
  • ESR 7.10 | SP009 | 000027
  • ESR 7.10 | SP010 | 000020
  • ESR 7.10 | SP011 | 000020
  • ESR 7.10 | SP012 | 000014
  • ESR 7.10 | SP013 | 000000
  • ESR 7.11 | SP004 | 000022
  • ESR 7.11 | SP005 | 000030
  • ESR 7.11 | SP006 | 000005
  • ESR 7.11 | SP007 | 000000
  • ESR 7.30 | SP001 | 000002
  • ESR 7.30 | SP002 | 000001
  • ESR 7.30 | SP003 | 000000
  • XI ADAPTER FRAMEWORK 7.10 | SP008 | 000036
  • XI ADAPTER FRAMEWORK 7.10 | SP009 | 000023
  • XI ADAPTER FRAMEWORK 7.10 | SP010 | 000014
  • XI ADAPTER FRAMEWORK 7.10 | SP011 | 000004
  • XI ADAPTER FRAMEWORK 7.10 | SP012 | 000001
  • XI ADAPTER FRAMEWORK 7.10 | SP013 | 000000
  • XI ADAPTER FRAMEWORK 7.11 | SP003 | 000040

Affected component

    BC-XI
    NetWeaver Process Integration (PI)

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1557806

TAGS

#Authentication
#authentication-step
#rtc/dir
#rtc/rep
#rtc/run