Advisory
SAP takes the security of its vast product portfolio very seriously and thus releases security fixes for
vulnerabilities reported by external researchers and their customers every second Tuesday of the month.
SAP Note 3504847
was released on
10.12.2024 and deals with
"[CVE-2024-47576] DLL Hijacking vulnerability in SAP Product Lifecycle Costing" within SAP Product Lifecycle Costing.
We advice you to follow the instructions, to resolve
os command injection
with a
low potential for exploitation
in component PLM-PLC.
According to SAP Security Advisory team a workaround does not exist. It is advisable to implement the correction as part of maintenance.
Risk specification
SAP Product Lifecycle Costing Client allows an attacker with system access to replace a legitimate DLL with a malicious one, resulting in the attacker being able to execute commands as if they were part of the SAP Product Lifecycle Costing Client Application.Solution
An alternative was implemented that does not require the DLL import.
The advisory is valid for
- PLC_CLIENT 4
- 9.9 [CVE-2021-37531] Code Injection vulnerability in SAP NetWeaver Knowledge Management (XMLForms)
- 9.1 Update 1 to 3350297 - [CVE-2023-36922] OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
- 9.1 [CVE-2023-36922] OS command injection vulnerability in SAP ECC and SAP S/4HANA (IS-OIL)
- 9.1 Update 2 to Security Note 2808158: [CVE-2019-0330] OS Command Injection vulnerability in SAP Diagnostics Agent
- 9.1 [CVE-2020-26820] Privilege escalation in SAP NetWeaver Application Server for Java (UDDI Server)
