CVE-2013-3061

The ISHMED-PATRED_TRANSACT_RFCCALL function in the IS-H Industry-Specific Component Hospital subsystem in SAP Healthcare Industry Solution, and the SAP ERP central component (aka ECC 6), allows remote authenticated users to bypass intended transaction restrictions via unspecified vectors.

• CWE-264

• http://archives.neohapsis.com/archives/bugtraq/2013-04/0176.htmlBroken Link
• http://scn.sap.com/docs/DOC-8218Broken Link
• http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/36-privilege-escalation-in-sap-is-healthcareBroken Link
• https://service.sap.com/sap/support/notes/1691744Permissions Required
• http://archives.neohapsis.com/archives/bugtraq/2013-04/0176.htmlBroken Link
• http://scn.sap.com/docs/DOC-8218Broken Link
• http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/36-privilege-escalation-in-sap-is-healthcareBroken Link
• https://service.sap.com/sap/support/notes/1691744Permissions Required

Published

May 1, 2013

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2013-3055Lexmark Markvision Enterprise before 1.8 provides a diagnost…
• CVE-2013-3056Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows re…
• CVE-2013-3057Joomla! 2.5.x before 2.5.10 and 3.0.x before 3.0.4 allows re…
• CVE-2013-3058Cross-site scripting (XSS) vulnerability in Joomla! 2.5.x be…
• CVE-2013-3059Cross-site scripting (XSS) vulnerability in the Voting plugi…
• CVE-2013-3060The web console in Apache ActiveMQ before 5.8.0 does not req…
• CVE-2013-3062The CP_RC_TRANSACTION_CALL_BY_SET function in the Engineerin…
• CVE-2013-3063SAP BASIS Communication Services 4.6B through 7.30 allows re…
• CVE-2013-3064Open redirect vulnerability in ui/dynamic/unsecured.html in …
• CVE-2013-3065Cross-site scripting (XSS) vulnerability in the Parental Con…
• CVE-2013-3066Linksys EA6500 with firmware 1.1.28.147876 does not properly…
• CVE-2013-3067Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS.5.4