SAP Security Note
Medium priority
SAP security note 2342940, "Information Disclosure in System Landscape Directory", is a program error note released on 08.11.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
Under certain conditions, the System Landscape Directory allows an attacker to access information which would otherwise be restricted.
Some well-known impacts of Information Disclosure are:
Loss of information and system configuration confidentiality.
Information gathering for further exploits and attacks.
Solution
Update your AS Java to a Support Package (SP) or release where the issue is fixed. See the Support Package Patches section below for details and available patches.
CVSS
Score 5.3 / 10 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Full note on SAP: SAP Support Launchpad note 2342940
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].