SAP Security Note
SAP security note 1499993, "Insecure default configuration of ACLs in KM", is a note released on 12.04.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
After installation, all KM repositories and their subfolders have the default permission "Everyone: Full Control". Since all users belong to the Everyone-user-group by default, it may allow newly registered users to access and compromise the repositories and documents.
Solution
To restrict access to KM repositories and secure content and configurations, appropriate permissions must be assigned.
A CTC configuration task assigns permissions to the following repositories: com.sap.netweaver.kmc.expimp, discussiongroups, entrypoints, grouphome, ice, rolehome, reporting, taxonomies, taxdata, userhome, ~system, documents, com.sap.km.appl, com.sap.kmc.transport, indexmanagement.
The execution of the configuration for SAP NetWeaver 7.30 can be found in the Knowledge Management section here.
Automatic CTC Configuration applies to:
- Patch 1 for SAP NetWeaver 7.30 SP 1
- SAP NetWeaver 7.30 SP 2
Manual solution required for:
- SAP NetWeaver 04
- SAP NetWeaver 7.0
- SAP EHP1 for SAP NetWeaver 7.0
- SAP EHP2 for SAP NetWeaver 7.0
Please apply the steps described in SAP Note 599425.
CVSS
Score 6.5 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
References
This note refers to
Referenced by
Affected components
- LM-PORTAL: 7.30 to 7.30
- KMC-BC: 7.00 to 7.02
- KMC-CM: 7.00 to 7.02
- KMC-COLL: 7.00 to 7.02
- LMCFG: 7.30 to 7.30
- EP-CM: 6.0_640 to 6.0_640
Full note on SAP: SAP Support Launchpad note 1499993
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].