SAP Security Note
Low priority
SAP security note 1437237, "Explicitly coded user names in Web Dynpro", is a program error note released on 21.05.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Web Dynpro contains source code whose flow logic behaves differently depending on the user who is logged on to the SAP system.
Solution
Import the relevant Support Package or implement the relevant correction instructions.
Reason and prerequisites
The program code contains an explicitly coded user name, whereby the flow logic of the program behaves differently depending on the user who is logged on. Therefore, the user can receive information that cannot actually be seen, for example.
Affected components
- SAP_BASIS: 700-702 and 710-720
Full note on SAP: SAP Support Launchpad note 1437237
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
