SAP security note 1453605, "Potential information disclosure relating to ECC and SAP R/3", is a program error note released on 14.09.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can discover information relating to key fields of arbitrary database table content.
Solution
Apply the attached correction instructions or implement the HR support packages in which the corrections have been included.
Reason and prerequisites
Any information stored in SAP database tables can be discovered through use of ABAP program HJPU_CHARCODE_CHECKER. A valid and authenticated user and authorization for transaction SA38, SE38 or PC00_M22_CHAR_CHECK is required.
CVSS
Score 0
References
This note refers to
Affected components
- SAP_HR 46C
- SAP_HR 470
- SAP_HR 500
- SAP_HR 600
- SAP_HR 604
- SAP_HRCJP 470
- SAP_HRCJP 500
- SAP_HRCJP 600
- SAP_HRCJP 604
Full note on SAP: SAP Support Launchpad note 1453605
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].