Potential modif. or disclosure of persisted data in WFM, SAP security note 1638596
Description
An attacker can exploit WFM (Workforce Management) and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information, or the modification of data persisted by the system.
The following function modules are concerned:
- WFACS_CALCSTATUSES_GET
- WFATM_CLEAN_TEMP_TABLES
- WFA_DATE_DEP_ADD
- WFA_DATE_DEP_ADD_HISTORY
- WFA_DATE_DEP_PARENT_ADD
- WFA_TEXT_MODIFY
Available fix and Supported packages
- RTLWFM | 100 | 100
- RTLWFM | 310 | 310
- RTLWFM 310 | SAPK-31010INRTLWFM |
- RTLWFM 100 | SAPK-10015INRTLWFM |
Affected component
- CA-GTF-WFA
please use CRM-WFD(Workforce Management Application)
CVSS
Score: 0
Exploit
Exploit is not available.
For detailed information please contact the mail [email protected]
URL
https://launchpad.support.sap.com/#/notes/1638596