SAP security note 2741201, "[CVE-2019-0278] Information Disclosure in the SAP NetWeaver Process Integration (Messaging System)". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Under certain conditions, the Monitoring Servlet of the Messaging System allows an attacker to see information like names of DB tables which would otherwise be restricted.
Some well-known impacts of Information Disclosure are:
- Loss of information and system configuration confidentiality
- Information gathering for further exploits and attacks
Solution
This issue is fixed with the Support Packages and Patches of the Software Components referenced by this note.
Reason and prerequisites
Messaging System’s monitoring servlet shows the name of DB tables used by the application.
CVSS
Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Affected components
- Basis Components > NetWeaver Process Integration (PI) > Connectivity > Messaging System (Versions: 7.10 – 7.50)
Full note on SAP: SAP Support Launchpad note 2741201
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].