SAP security note 1898046, "Potential Modification/Disclosure of Persisted Data in BW-SYS-DB", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can exploit BW-SYS-DB-HDB and use specially crafted inputs to modify database commands. This can result in either the retrieval of additional information or the modification of data persisted by the system.
Solution
To address this vulnerability, import the appropriate support package for your SAP NetWeaver BW version as listed above. Additionally, you can implement the correction instructions as an advance correction. Make sure to first read SAP Note 875986, which provides information about transaction SNOTE.
CVSS
Score 7.5 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:C
Affected components
- SAP NetWeaver BW 7.30
- SAP NetWeaver BW 7.31 (SAP NW BW 7.0 Enhancement Package 3)
- SAP NetWeaver BW 7.40
Full note on SAP: SAP Support Launchpad note 1898046
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
