CVE-2013-3678: Multiple unspecified vulnerabilities in SAP Governance, Risk, and Compliance (GRC) allow remote authenticat...

Security readout for executives and security teams

CVE-2013-3678 concerns SAP Governance, Risk, and Compliance. The public CVE says authenticated remote users could gain privileges and execute arbitrary programs through crafted RFC or SOAP-RFC requests. That is serious for organizations relying on SAP GRC for access governance, but the provided record lacks CVSS, affected version details, and explicit patch text. Likely exposure is limited to organizations running SAP GRC with RFC or SOAP-RFC paths available to authenticated users. Actual exposure cannot be confirmed from the bundle because affected versions and CPEs are listed as unavailable. SAP Note 2039348 should be used to determine product and version applicability. Treat this as a high-priority SAP governance risk if SAP GRC is in use. The impact could undermine access-control processes and allow program execution, but urgency depends on whether your versions match SAP Note 2039348 and whether authenticated RFC/SOAP-RFC access is exposed. Mitigation focus: Check SAP Note 2039348 for affected versions and vendor remediation.; Apply SAP-provided corrections where the note is applicable.; Restrict RFC and SOAP-RFC access to trusted users and networks..

Prepared

Jun 14, 2026, 06:22 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.