SAP security note 2059659, "Hardcoded credentials in BC-CUS-TOL-CST". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The BC-CUS-TOL-CST component contains code that alters the program's behavior when a user is successfully authenticated with specific credentials. An attacker could exploit this by authenticating without legitimate credentials or by escalating privileges if the hardcoded account has higher access rights.
Solution
Implement SAP Note 2059659 to address the vulnerability. Ensure that all relevant support packages are applied to your SAP_BASIS components.
CVSS
Score 3.6 / 10 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:N
Affected components
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 731
- SAP_BASIS 740
Full note on SAP: SAP Support Launchpad note 2059659
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
