SAP security note 1913554, "Hard-coded credentials in Suite BOPF". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Suite BOPF contains code that changes the program’s behavior when a user is successfully authenticated with a certain user name.
Solution
The special code for the user is removed.
Please apply the support package mentioned in this note, or the respective correction instruction.
Reason and prerequisites
The program code contains a hard-coded user name that changes the system’s behavior if a user is successfully authenticated. The user may obtain additional information that should not be displayed.
CVSS
Score 4.9 Vector: AV:N/AC:M/AU:S/C:P/I:N/A:P
Full note on SAP: SAP Support Launchpad note 1913554
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].