Skip links

Code injection vulnerability in Bulgarian Cash Flow and Equity Reports, SAP security note 2023877

Description

Bulgarian Cash and Equity Reports contain code that permits the execution of arbitrary program code of the user’s choice.
An attacker can therefore control the behavior of the system, or can potentially escalate privileges by executing malicious code, without having their own legitimate credentials.

Available fix and Supported packages

  • C-CEE | 110_600 | 110_600
  • C-CEE | 110_602 | 110_602
  • C-CEE | 110_603 | 110_603
  • C-CEE | 110_604 | 110_604
  • C-CEE 110_600 | SAPK-11039INCCEE |
  • C-CEE 110_602 | SAPK-60225INCCEE |
  • C-CEE 110_603 | SAPK-60325INCCEE |
  • C-CEE 110_604 | SAPK-60423INCCEE |

Affected component

    XX-CSC-BG-FI
    Financial Accounting

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2023877

TAGS

#Injection
#run
#credentials
#Bulgaria
#Cash-Flow&160-Report
#Equity-Report
#/BGLOCS/FI_CFSREP_TOP
#/BGLOCS/FI_EQREP_TOP
#/BGLOCS/FI_EQREP01_TOP
#/BGLOCS/FI_EQREP02_TOP