SAP Note 1576399
SAP Security Note
High priority
SAP Security Note
High priority
SAP security note 1576399, "Hard-coded Username/Password in [BC-CUS, BC-CUS-TOL-IMG]", is a program error note released on December 13, 2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The program code in BC-CUS-TOL-IMG contains a hard-coded username and password combination. This poses significant security risks:
- Unauthorized Authentication: Malicious users can authenticate to BC-CUS-TOL-IMG without legitimate credentials.
- Privilege Escalation: If the hard-coded account has higher access rights, it may allow users to escalate their privileges beyond intended levels.
Impact:
- Backdoor Access: Unauthorized individuals can gain access to the system, bypassing standard authentication mechanisms.
- Data Breach Risk: Access to sensitive information and system functionalities without proper authorization.
Solution
Apply the corrections provided in this SAP Security Note to mitigate the vulnerability. Follow the detailed correction instructions available here.
Affected components
- SAP_BASIS: 46C, 620 to 640, 700 to 702, 710 to 730, 72L to 800
Full note on SAP: SAP Support Launchpad note 1576399
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
