Skip links

User-driven dynamic procedure calls vulnerability in C-CEE add-on, SAP security note 2024315

Description

C-CEE add-on contain user-driven dynamic procedure calls that permit the execution of arbitrary program code of the user’s choice.
An attacker can therefore control the behavior of the system, or can potentially escalate privileges by executing malicious code, without having their own legitimate credentials

An attacker can be authenticated to affected reports without having their own legitimate credentials, or they may escalate privileges.

Available fix and Supported packages

  • C-CEE | 110_600 | 110_600
  • C-CEE | 110_602 | 110_602
  • C-CEE | 110_603 | 110_603
  • C-CEE | 110_604 | 110_604
  • C-CEE 110_600 | SAPK-11039INCCEE |
  • C-CEE 110_602 | SAPK-60225INCCEE |
  • C-CEE 110_603 | SAPK-60325INCCEE |
  • C-CEE 110_604 | SAPK-60423INCCEE |

Affected component

    XX-CSC-BG-FI
    Financial Accounting

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2024315

TAGS

#C-CEE
#user-driven-dynamic-procedure-call
#/BGLOCS/VATREPORT07_MENU
#MJ1GFBWEF15