Potential disclosure of information about parameters, SAP security note 1584930

SAP security note 1584930, “Potential disclosure of information about parameters”, is a note released on 14.02.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can discover information relating to any R/3 profile parameter. This information could be used for a targeted attack against an SAP system.

Solution

A program change has been implemented to ensure the affected function module only supports the reading of the application server name. This change is included in the following Support Packages. For older Support Packages, apply the program change using SNOTE.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

References

• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS (700 to 702, 710 to 730)