HTTP verb tampering issue in Java MapBox, SAP security note 1642179

SAP security note 1642179, "HTTP verb tampering issue in Java MapBox", is a note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

In Java MapBox, there are problems with authorization and authentication checks if certain HTTP methods are used. An attacker can control the behavior of the system, or potentially escalate privileges by executing malicious code, without having legitimate credentials.

Solution

Apply the patch as specified in the ‘SP Patch Level’ section of this note.

Reason and prerequisites

Java MapBox contains HTTP verb tampering vulnerabilities. This means that there is a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests that contain unexpected HTTP methods.

Affected components

• MAPBOX 4.0