Potential disclosure of user information, SAP security note 2054566

SAP Note 2054566SAP Security NoteLow priority

SAP security note 2054566, “Potential disclosure of user information”, is a program error note released on 09.09.2014. Below is the security information published by SAP for this note.

ComponentBasis Components > Business Management > Business Workflow > Designtime

CategoryProgram error

PriorityCorrection with low priority

TypeSAP Security Note

Version1

StatusReleased for Customer

Released on09.09.2014

LanguageEnglish (Master Language: German)

Description

Symptom

An attacker can access information related to users. This information could be used to allow the attacker to specialize their attacks against on users and BC-BMT-WFM-DEF.

Reason and prerequisites

Information such as user passwords can be disclosed using BC-BMT-WFM-DEF. This information may be used by an attacker to further target users.

Solution

The involved test program has been disabled and can no longer be executed.

Full note on SAP: SAP Support Launchpad note 2054566

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Designtime