SAP security note 1637451, "Encryption of credit card data in DSD", addresses the following vulnerability. Below are the symptom, SAP recommended solution and reason for this note.
Description
Symptom
An attacker can discover information relating to credit card data that is used in the Direct Store Delivery (DSD) process. This information could be used to allow the attacker to specialize their attacks against credit cards.
Solution
Implement the relevant Support Package that contains this SAP Note. Manual corrections are not required.
Reason and prerequisites
Information such as credit card numbers can be discovered using DSD. This information may be used by an attacker to target credit cards.
Full note on SAP: SAP Support Launchpad note 1637451
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].