CVE-2016-7435

Critical

Published: 05/10/2016(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The SCTC_REFRESH_EXPORT_TAB_COMP, SCTC_REFRESH_CHECK_ENV, and SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via a CALL 'SYSTEM' statement.

Risk Assessment

This vulnerability could lead to unauthorized execution of system commands, posing a significant security risk to the organization's system and data.

Recommendation

It is recommended to update to the latest version of SAP Netweaver and to restrict user permissions to the minimum necessary.

Original NVD description (English source)

The (1) SCTC_REFRESH_EXPORT_TAB_COMP, (2) SCTC_REFRESH_CHECK_ENV, and (3) SCTC_TMS_MAINTAIN_ALOG functions in the SCTC subpackage in SAP Netweaver 7.40 SP 12 allow remote authenticated users with certain permissions to execute arbitrary commands via vectors involving a CALL 'SYSTEM' statement, aka SAP Security Note 2260344.