Skip links

Potential modif. or disclosure of persisted data in WFM, SAP security note 1638596

Description

An attacker can exploit WFM (Workforce Management) and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information, or the modification of data persisted by the system.
The following function modules are concerned:

  • WFACS_CALCSTATUSES_GET
  • WFATM_CLEAN_TEMP_TABLES
  • WFA_DATE_DEP_ADD
  • WFA_DATE_DEP_ADD_HISTORY
  • WFA_DATE_DEP_PARENT_ADD
  • WFA_TEXT_MODIFY

Available fix and Supported packages

  • RTLWFM | 100 | 100
  • RTLWFM | 310 | 310
  • RTLWFM 310 | SAPK-31010INRTLWFM |
  • RTLWFM 100 | SAPK-10015INRTLWFM |

Affected component

    CA-GTF-WFA
    please use CRM-WFD(Workforce Management Application)

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1638596

TAGS

#SQL-injection
#database
#WFM