SAP Note 2389764
SAP security note 2389764, “BW Workspaces: Analysis authorization during modeling and running local hierarchies”. Below are the symptom and the SAP recommended solution.
Description
Symptom
Under certain conditions, BW Workspaces allows an attacker to access information which would otherwise be restricted.
Impacts of Information Disclosure:
- Loss of information and system configuration confidentiality
- Information gathering for further exploits and attacks
Solution
Apply the appropriate Support Package for your SAP BW system:
- SAP BW 7.40: Implement Support Package 17 (SAPKW74017) for SAP BW 7.40. Detailed information is available in SAP Note 2365926.
- SAP BW 7.50: Implement Support Package 8 for SAP BW 7.50 (SAPK-75008INSAPBW). Detailed information is available in SAP Note 2419099.
- SAP BW 7.51: Implement Support Package 3 for SAP BW 7.51 (SAPK-75103INSAPBW). Detailed information is available in SAP Note 2424895.
- SAP BW/4HANA 1.0: Implement Support Package 3 for SAP BW/4HANA 1.0 (SAPK-10003INDW4CORE). Detailed information is available in SAP Note 2407087.
Full note on SAP: SAP Support Launchpad note 2389764
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].