SAP security note 1516216, "Hard-coded credentials in BC-CUS-TOL-IMG". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The program behavior changes when a user authenticates with a specific hard-coded username. This allows unauthorized access or privilege escalation if exploited.
A malicious user can authenticate to BC-CUS-TOL-IMG without having legitimate credentials. If the hard-coded account has higher access rights, this could lead to an escalation of privileges and unauthorized access to sensitive information.
Solution
Apply the corrections provided in Security Note 1516216. Ensure that all relevant SAP_BASIS components are updated with the appropriate support packages as listed in the note.
References
Affected components
- SAP_BASIS 46B to 46D
- SAP_BASIS 610 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 800
Full note on SAP: SAP Support Launchpad note 1516216
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
