SAP Operational Data Provisioning ODP-RFC Caller Identification Vulnerability

A vulnerability exists in the Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC). These modules lack proper identification of permitted SAP-internal applications, allowing customer or third-party applications to use them in unintended ways. This could result in unauthorized data disclosure, although it does not compromise data integrity and only minimally impacts application availability.

Impact

The vulnerability could lead to unintended data disclosure.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform, where users can find a complete list of security updates and patches. For SAP NetWeaver based products, security fixes are delivered with support packages.