SAP Security Note
Low priority
SAP security note 2354254, “Information Disclosure in SAP Business Intelligence Analysis for OLAP”, is a program error note released on 13.12.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can discover information sent or retrieved by the Multi-Dimensional Analysis Service. The service is used by Analysis for OLAP.
Some well-known impacts of Information Disclosure are:
- Loss of information and system configuration confidentiality
- Attacker can specialize their attacks against BW systems
Solution
To mitigate the issue, use SSO in OLAP connections. This issue is fixed in the patches listed in the “Support Packages & Patches” section below. For Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559 in the References section.
Reason and prerequisites
The information disclosure only occurs if the Business Intelligence user has no administrator rights.
CVSS
Score 0
References
This note refers to
Full note on SAP: SAP Support Launchpad note 2354254
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].