Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Potential information disclosure relating to Business Data, SAP security note 1974046

SAP Note 1974046
SAP Security Note
High priority

SAP security note 1974046, "Potential information disclosure relating to Business Data", is a program error note released on April 8, 2014. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Enterprise Service Infrastructure > Enterprise Service Framework Layer > Business Service Adaptation
CategoryProgram error
PriorityHigh priority
TypeSAP Security Note
Version1
StatusReleased for Customer
Released onApril 8, 2014
LanguageEnglish

Description

Symptom

An attacker can discover information relating to business data who uses SADL-Query based OWLs. This information could be used to allow the attacker to specialize their attacks against business data.

Solution

Please apply the support package mentioned in this note, i.e., Hotfix 55960.

Reason and prerequisites

Information such as the business data can be discovered using SADL-Query based OWLs. This information may be used by an attacker to further target competitors and partners.

CVSS

Score 3.5 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:N

Full note on SAP: SAP Support Launchpad note 1974046

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Information disclosure#SADL Query#OWL#Object Work List

Explore More