SAP security note 2344524, "Information Disclosure in Guided Procedures". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
This security note has been updated. For more detailed information, see Security Note 2375140.
Under certain conditions, the Guided Procedures Webdynpro component allows an attacker to access information which would otherwise be restricted.
Some well-known impacts of Information Disclosure are:
- Information gathering for further exploits and attacks
Solution
To correct this problem, apply the patch matching your support package version as listed in the Support Packages & Patches table below as per the instructions in the SAP NetWeaver Support Package Stack Guide.
Reason and prerequisites
Program error.
CVSS
Score 5.3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Referenced by
- SAP Note 2349060 – Central Note: SAP NetWeaver 7.5 SPS05 – Guided Procedures
Affected components
- SAP-EU 7.00 to 7.02
- GP-CORE 7.10 to 7.11
- GP-CORE 7.20
- GP-CORE 7.30
- GP-CORE 7.31
- GP-CORE 7.40
- GP-CORE 7.50
Full note on SAP: SAP Support Launchpad note 2344524
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].