CVE-2013-3061

MediumCVSS 6.5/10Last modified Jun 16, 2026

Description

The ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital subsystem in SAP Healthcare Industry Solution, and the SAP ERP central component (aka ECC 6), allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.

Metrics

CVSS 2.0 6.5/10AV:N/AC:L/Au:S/C:P/I:P/A:P

Weakness enumeration

CWE-264

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://archives.neohapsis.com/archives/bugtraq/2013-04/0176.htmlBroken Link
http://scn.sap.com/docs/DOC-8218Broken Link
http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/36-privilege-escalation-in-sap-is-healthcareBroken Link
https://service.sap.com/sap/support/notes/1691744Permissions Required
http://archives.neohapsis.com/archives/bugtraq/2013-04/0176.htmlBroken Link
http://scn.sap.com/docs/DOC-8218Broken Link
http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/36-privilege-escalation-in-sap-is-healthcareBroken Link
https://service.sap.com/sap/support/notes/1691744Permissions Required

Timeline

Published: May 1, 2013
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-30626.5The CP_RC_TRANSACTION_CALL_BY_SET function in the Engineering Workbench component in SAP Production Planning and Control allows remote authe CVE-2013-30636.0SAP BASIS Communication Services 4.6B through 7.30 allows remote authenticated users to execute arbitrary commands via unspecified vectors.CVE-2013-30646.8Open redirect vulnerability in ui/dynamic/unsecured.html in Linksys EA6500 with firmware 1.1.28.147876 allows remote attackers to redirect u CVE-2013-30653.5Cross-site scripting (XSS) vulnerability in the Parental Controls section in Linksys EA6500 with firmware 1.1.28.147876 allows remote authen CVE-2013-30667.1Linksys EA6500 with firmware 1.1.28.147876 does not properly restrict access, which allows remote attackers to obtain sensitive information CVE-2013-30675.4Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.CVE-2013-30686.8Cross-site request forgery (CSRF) vulnerability in apply.cgi in Linksys WRT310Nv2 2.0.0.1 allows remote attackers to hijack the authenticati CVE-2013-30693.5Multiple cross-site scripting (XSS) vulnerabilities in NETGEAR WNDR4700 with firmware 1.0.0.34 allow remote authenticated users to inject ar CVE-2013-30707.5An Information Disclosure vulnerability exists in Netgear WNDR4700 running firmware 1.0.0.34 in the management web interface, which disclose CVE-2013-30719.8NETGEAR Centria WNDR4700 devices with firmware 1.0.0.34 allow authentication bypass.CVE-2013-30729.8An Authentication Bypass vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34 in http://<router_ip>/apply.cgi?/hdd_usr_setup.h CVE-2013-30739.8A Symlink Traversal vulnerability exists in NETGEAR Centria WNDR4700 Firmware 1.0.0.34.