SAP Security Note
High priority
SAP security note 2182842, "Potential information disclosure relating to SAP Customizing", is a program error note released on 11.08.2015. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to SAP Customizing of SAP Business Applications. This information could be used to allow the attacker to specialize their attacks against SAP Business Applications in different clients or tenants.
Solution
The correction ensures that the client restrictions apply. This security note is relevant only and exactly for 731 SP08 and 740 SP03. For further information as well as the correction, please refer to SAP Note 1859065.
Reason and prerequisites
Information such as the SAP Business Configuration can be discovered using SAP Customizing. This information may be used by an attacker to further target SAP Business Applications residing in a different client.
References
This note refers to
Affected components
- SAP_BASIS 731 to 731
- SAP_BASIS 740 to 740
Full note on SAP: SAP Support Launchpad note 2182842
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].