Description
UPDATE 22nd December 2020: This note has been re-released with updated ‘Support Packages & Patches’ information. We have added SP 016 to the version J2EE ENGINE SERVERCORE 7.50.
Under certain conditions, SAP NetWeaver AS Java allows an attacker with administrative privileges to access information and user sensitive data such as passwords in trace files, when the user logs in and sends request with login credentials, leading to information disclosure.
Some well-known impacts of Information Disclosure are:
- loss of information and system configuration confidentiality;
- information gathering for further exploits and attacks.
Available fix and Supported packages
- SERVERCORE | 7.10 | 7.10
- SERVERCORE | 7.11 | 7.11
- SERVERCORE | 7.20 | 7.20
- SERVERCORE | 7.30 | 7.30
- SERVERCORE | 7.31 | 7.31
- SERVERCORE | 7.40 | 7.40
- SERVERCORE | 7.50 | 7.50
- J2EE ENGINE SERVERCORE 7.10 | SP024 | 000004
- J2EE ENGINE SERVERCORE 7.10 | SP025 | 000000
- J2EE ENGINE SERVERCORE 7.11 | SP019 | 000006
- J2EE ENGINE SERVERCORE 7.11 | SP020 | 000000
- J2EE ENGINE SERVERCORE 7.20 | SP009 | 000143
- J2EE ENGINE SERVERCORE 7.30 | SP020 | 000004
- J2EE ENGINE SERVERCORE 7.30 | SP021 | 000000
- J2EE ENGINE SERVERCORE 7.31 | SP026 | 000003
- J2EE ENGINE SERVERCORE 7.31 | SP027 | 000000
- J2EE ENGINE SERVERCORE 7.40 | SP021 | 000003
- J2EE ENGINE SERVERCORE 7.40 | SP022 | 000000
- J2EE ENGINE SERVERCORE 7.50 | SP016 | 000032
- J2EE ENGINE SERVERCORE 7.50 | SP017 | 000003
- J2EE ENGINE SERVERCORE 7.50 | SP018 | 000000
- J2EE ENGINE SERVERCORE 7.50 | SP019 | 000000
Affected component
- BC-JAS-WEB
Web Container, HTTP, JavaMail, Servlets
CVSS
Score: 6.2
CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:N/A:N
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2826528
