important · Research
A low-privileged SAP backend user can make SAP GUI for Java execute commands on an operator's workstation.
Affects
SAP GUI for Java, the cross-platform desktop client used to operate SAP NetWeaver backend systems.
The client fails to enforce its trust policy when manipulated backend content invokes affected GUI functionality, crossing an existing backend foothold into the operator's command context.