Medium priority
SAP security note 2672919, "[CVE-2018-2459] Information disclosure in SAP Mobile Platform server Offline OData", is a note released on September 11, 2018. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Users utilizing an Offline OData application with Offline OData-supplied delta tokens may occasionally receive data values belonging to different users. This occurs when multiple users synchronize simultaneously, resulting in the retrieval of entities with identical key values but differing property values.
The vulnerability allows unintended information disclosure due to the assumption of globally unique entity IDs in multi-threaded access scenarios, potentially exposing user data to other users.
Solution
SAP has updated the delta calculation algorithm to no longer assume globally unique entity IDs. The new implementation is thread-safe, preventing the aforementioned data disclosure.
CVSS
Score 4.3 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected components
- SAP Mobile Platform on Premise Offline OData Server (MOB-ONP-OOD), Version 3.0
Full note on SAP: SAP Support Launchpad note 2672919
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
