SAP security note 2372188, "Information Disclosure in Business Process Management", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Under certain conditions, Business Process Management allows an attacker to access information which would otherwise be restricted.
Some well-known impacts of Information Disclosure are:
- Loss of information and system configuration confidentiality
- Information gathering for further exploits and attacks
Solution
Apply the patch matching your support package version as listed in the Support Package Patches section of this SAP Note. Follow the instructions in the SAP NetWeaver Support Package Stack Guide.
CVSS
Score 5.3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
References
Full note on SAP: SAP Support Launchpad note 2372188
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
