OS Command Injection in SAP Forecasting & Replenishment
SAP Forecasting & Replenishment
Admin-level OS command execution is a significant risk in any environment where F&R admins are not also OS administrators. If you run F&R, schedule this within two weeks. The "admin authorisations required" caveat reduces urgency but does not eliminate it.
Vulnerability Detail
Insufficient control over operating system commands in five function modules allows an authenticated attacker with administrative authorisations to execute arbitrary OS commands. The affected functions are not remote-enabled, but exploitation by a privileged user has high impact on confidentiality, integrity, and availability.
Workaround
Restrict administrative authorisations for F&R-related transactions. Review S_RFC and S_TCODE grants for the five affected function modules.
Patch Action
Apply SAP Note 3732471.
Affected Versions
Patch Info