Detect Detailed Error Messages at the Front End, SAP security note 1633166

SAP Note 1633166
SAP Security Note
Medium priority

SAP security note 1633166, “Detect Detailed Error Messages at the Front End”, is a program error note released on 13.12.2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentEnterprise Portal > SAP Enterprise Portal (On Premise) > Navigation

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released on13.12.2011

LanguageEnglish

Description

Symptom

When a JAVA Exception is thrown, the program can supply the stack trace and/or an error message from the last call. A malicious user can discover information relating to Portal Navigation.

Solution

Use the patch from the "SP Patch Level" tab page.

Reason and prerequisites

Information such as the stack trace can be discovered in an extreme scenario which might throw an Error Messages at the Front End.

CVSS

Score 0

Affected components

EP-RUNTIME 7.30 to 7.30
EP-RUNTIME 7.31 to 7.31

Full note on SAP: SAP Support Launchpad note 1633166

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Stack trace #Information disclosure #Navigation