Skip links

Unauthorized usage of SWP services, SAP security note 1520101

Description

This security note has been updated.
For more detailed information, see Security Note 1727640.

A malicious user can trigger functionalities in the Supplier Workplace services without authentication and authorization. The user can perform actions for which he has no authorization.
The following services can be affected and have now been protected.
1. ISA_SICKANBAN
2. ISA_SICALERT
3. ISAUTO_SICRPM
4. ISAUTO_SICBC
5. ISAUTO_SICASN1
6. ISAUTO_SICASN2
7. ISAUTO_SICASN3
8. ISAUTO_SICASN4
9. ISAUTO_SICCO
10.ISAUTO_SICENG
11.ISAUTO_SICDDL1
12. ISAUTO_SICENG
13. ISAUTO_SICJIT
14. ISAUTO_SICPDI
15. ISAUTO_SICPH
16. ISAUTO_SICPI
17. ISAUTO_SICRL
18. ISAUTO_SICRLRD
19. ISAUTO_SICRPM
20. ISIPI_CS
21. ISIPI_CP
22. ISIPI_ESP
23. ISIPI_OEPM
24. ISIPI_PUL
25. ISIPI_SUMJIT
26. ISIPI_TRACK
27. ISIPI_SM
28. ISIPI_POD
29. ISAUTO_SIC
30. ISIPI_CE

Available fix and Supported packages

  • ECC-DIMP | 500 | 500
  • ECC-DIMP | 600 | 600
  • ECC-DIMP | 602 | 602
  • ECC-DIMP | 603 | 603
  • ECC-DIMP | 604 | 604
  • ECC-DIMP | 605 | 605
  • ECC-DIMP 600 | SAPK-60019INECCDIMP |
  • ECC-DIMP 500 | SAPKIPMH14 |
  • ECC-DIMP 602 | SAPK-60209INECCDIMP |
  • ECC-DIMP 603 | SAPK-60308INECCDIMP |
  • ECC-DIMP 604 | SAPK-60409INECCDIMP |
  • ECC-DIMP 605 | SAPK-60503INECCDIMP |
  • ECC-DIMP 605 | SAPK-60509INECCDIMP |

Affected component

    IS-A-SWP
    Supplier Workplace

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1520101

TAGS

#Cross-Site-Request-Forgery
#XSRF
#ITS
#SWP-services
#ISAUTO
#ISIPI