SAP Note 1479637
SAP Security Note
Medium priority
SAP Security Note
Medium priority
SAP security note 1479637, "The reset logon page can be always requested", is a program error note released on 13.09.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
The reset password page in the logon application can be requested even when the ume.logon.logon_help property is set to FALSE. This opens the possibility for a user to guess the password of another user.
Solution
Please upgrade the SAP J2EE engine to the SP patch level mentioned in the note.
Reason and prerequisites
The problem occurs due to a program error in the SAP code.
References
Full note on SAP: SAP Support Launchpad note 1479637
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].