Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Unauthorized call of operating system command, SAP security note 1520462

Description

A malicious user can execute an operating system command with a parameter string by calling a certain ABAP function because the function does not perform any authorization checks.
In SAP terminology, these calls are referred to as ‘external programs’ or ‘external commands’ (See Note 677435 also.).

Available fix and Supported packages

  • SAP_APPL | 40B | 40B
  • SAP_APPL | 45B | 45B
  • SAP_BASIS | 46B | 46D
  • SAP_BASIS | 610 | 640
  • SAP_BASIS | 700 | 702
  • SAP_BASIS | 710 | 730
  • SAP_APPL 40B | SAPKH40B89 |
  • SAP_APPL 45B | SAPKH45B67 |
  • SAP_BASIS 46B | SAPKB46B62 |
  • SAP_BASIS 701 | SAPKB70108 |
  • SAP_BASIS 46C | SAPKB46C62 |
  • SAP_BASIS 730 | SAPKB73002 |
  • SAP_BASIS 620 | SAPKB62070 |
  • SAP_BASIS 710 | SAPKB71012 |
  • SAP_BASIS 702 | SAPKB70207 |
  • SAP_BASIS 711 | SAPKB71107 |
  • SAP_BASIS 720 | SAPKB72005 |
  • SAP_BASIS 640 | SAPKB64028 |
  • SAP_BASIS 700 | SAPKB70024 |

Affected component

    BC-CCM-BTC-EXT
    External and Logical Commands

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1520462

TAGS

#External-programs
#external-commands

More to explorer