CVE-2013-3061

Related Files

SAP Healthcare Industry Solution Privilege Escalation

Posted Apr 16, 2013

Authored by Ertunga Arsal | Site esnc.de

This vulnerability allows bypassing authority checks that exist before executing a transaction. A transaction in SAP terminology is the execution of a program. By exploiting this vulnerability, an attacker can also control the transaction to be executed, allowing it to obtain critical rights in the system and bypassing certain segregation of duties (SoD) restrictions. Although this vulnerability is found in the SAP industry solution for healthcare, the functionality is also present in the SAP ERP central component (ECC 6). Thus, customers in other industries are also affected.

tags | advisory

advisories | CVE-2013-3061

SHA-256 | 04068b72f2c992a2fd3f3c6c9328f3a8d53414cded64945a2d57f759d3167747

Download | Favorite | View