SAP Application Server ABAP Code Injection Vulnerability Allowing Arbitrary Code Execution

A code injection vulnerability has been identified in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform. This vulnerability allows authenticated attackers to send specially crafted inputs to the application. If these inputs are processed by the application, they could be delivered to users subscribed to the channel, resulting in execution of arbitrary code on behalf of those users. This exploitation would lead to a low integrity impact, with no effect on confidentiality or availability.

Impact

Exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary code on behalf of other users.

Remediation

Users are advised to consult the SAP Security Notes for guidance on applying patches and addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform.