SAP security note 1495675, “Potential information disclosure relating to password”, is released on 13.12.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information related to user passwords and the names of users who use NetWeaver Developer Studio (NWDS) to connect to the NetWeaver Development Infrastructure (NWDI) server. This information could be leveraged to tailor attacks against the NWDI server, potentially compromising components such as SLD, CMS, DTR, and CBS.
Solution
To mitigate this vulnerability, it is recommended to install the latest patch provided by SAP.
Affected components
- Basis Components > Change and Transport System > Development Infrastructure (NetWeaver Java) (BC-CTS-DI)
Full note on SAP: SAP Support Launchpad note 1495675
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].