SAP Security Note
High priority
SAP security note 1614345, “Removal of undocumented support functionality”, is a program error note released on February 14, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can gain access to undocumented features of the PI Integration Directory via the support web tool.
Solution
Apply the corrections attached to this note.
Reason and prerequisites
NetWeaver PI Integration Directory includes a support web tool used for various support activities. Some tasks within this tool could be potentially dangerous as they modify data in the Configuration Directory.
References
Affected components
- SAP_XITOOL (7.10 to 7.11, 7.30 to 7.30, 7.31 to 7.31)
Full note on SAP: SAP Support Launchpad note 1614345
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].