Potential disclosure of persisted data in BW-WHM-DBA-IOBJ, SAP security note 1836718

SAP security note 1836718, "Potential disclosure of persisted data in BW-WHM-DBA-IOBJ", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An SQL injection vulnerability exists in the BW-WHM-DBA-IOBJ component. An attacker can manipulate SQL statements by providing specially crafted inputs, enabling the retrieval of additional data from the database beyond intended access.

Successful exploitation of this vulnerability may allow attackers to access sensitive persisted data, potentially compromising the confidentiality of the information stored within the SAP system.

Solution

To mitigate this vulnerability, apply the relevant Support Package for your SAP NetWeaver BW version:

• SAP NetWeaver BW 7.00: Import Support Package 31 (SAPKW70031)
• SAP NetWeaver BW 7.01 EHP 1: Import Support Package 14 (SAPKW70114)
• SAP NetWeaver BW 7.02 EHP 2: Import Support Package 14 (SAPKW70214)
• SAP NetWeaver BW 7.11: Import Support Package 12 (SAPKW71112)
• SAP NetWeaver BW 7.30: Import Support Package 10 (SAPKW73010)
• SAP NetWeaver BW 7.31 EHP 3: Import Support Package 8 (SAPKW73108)
• SAP NetWeaver BW 7.40: Import Support Package 3 (SAPKW74003)

CVSS

Score 2.1 Vector: AV:N/AC:H/AU:S/C:P/I:N/A:N

Affected components

• SAP_BW: Versions 350, 700 to 740
• SAP_BW_VIRTUAL_COMP: Version 711