Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

CVE-2018-2503 Wrong default authorizations in AS Java keystore service, SAP security note 2658279

SAP Note 2658279
SAP Security Note
High priority

SAP security note 2658279, "[CVE-2018-2503] Wrong default authorizations in AS Java keystore service", is a program error note released on 11.12.2018. Below are the symptom and SAP recommended solution.

ComponentBasis Components > NetWeaver Application Server Java > Security, User Management (BC-JAS-SEC)
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released on11.12.2018
LanguageEnglish

Description

Symptom

By default, the keystore service does not sufficiently restrict access to resources that should be protected. Some known impacts of insufficient access restrictions include:

  • Read, modify, or delete sensitive information

Solution

Apply the corrective measures as per the ‘Validity’ and ‘Patch Level’ sections of this note.

CVSS

Score 7.4 Vector: CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

References

Full note on SAP: SAP Support Launchpad note 2658279

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Default access control configuration #CVE-2018-2503 #Keystore service

Explore More