Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Information Disclosure in SAP Landscape Management, SAP security note 2903743

Description

A disclosure vulnerability exists in the enterprise edition or standard edition of SAP Landscape Management that would allow an authenticated user with high privilege to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.

The information disclosed are the credentials. To fix the problem, proceed as follows:

  1. Implement SAP Landscape Management 3.0 SP14 Patch02.
  2. Remove all SAP NetWeaver Developer Traces and archives of traces with severity Path or higher.
  3. Change the affected credentials because the logs could have already been read.

The disclosed information can only be accessed by authenticated users with high privileges (J2EE administrator), but they can escalate their privileges to other systems.

Available fix and Supported packages

  • VCM | 3.00 | 3.00
  • VCM LVM 3.0 | SP014 | 000002

Affected component

    BC-VCM-LVM
    Landscape Virtualization Management

CVSS

Score: 8.7
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2903743

TAGS

#Information-Exposure
#Information-Leak
#LaMa
#LVM
#Provisioning

More to explorer

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.