SAP Security Note
Medium priority
SAP security note 1929338, "Potential information disclosure relating to System Landscape Directory ABAP Connectivity", is a program error note released on 10.12.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to passwords who uses transaction RZ70. This information could be used to allow the attacker to specialize their attacks against passwords and RZ70.
Solution
Use an appropriate Support Package or apply the attached correction instruction.
Reason and prerequisites
Information such as user passwords can be discovered using RZ70. This information may be used by an attacker to further target passwords.
CVSS
Score 2.3 Vector: AV:A/AC:M/AU:S/C:P/I:N/A:N
Full note on SAP: SAP Support Launchpad note 1929338
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].