SAP security note 1453604, "Potential information disclosure relating to ECC and SAP R/3", is a program error note released on 17.08.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can discover information relating to database table content of SAP text tables.
Solution
Apply the attached correction instructions or implement the HR support packages in which the corrections have been included.
Reason and prerequisites
Any information stored in SAP text tables can be discovered through use of the ABAP program RPUCDSE0, which can be misused as a generic table reader for text tables. A valid and authenticated user and authorization for transaction SA38 or SE38 is required.
CVSS
Score 0
References
This note refers to
Affected components
- SAP_HR 40B
- SAP_HR 46C
- SAP_HR 470
- SAP_HR 500
- SAP_HR 600
- SAP_HR 604
- SAP_HRCES 470
- SAP_HRCES 500
- SAP_HRCES 600
- SAP_HRCES 604
Full note on SAP: SAP Support Launchpad note 1453604
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].