Description
A disclosure vulnerability exists in the enterprise edition or standard edition of SAP Landscape Management that would allow an authenticated user with high privilege to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.
The information disclosed are the credentials. To fix the problem, proceed as follows:
- Implement SAP Landscape Management 3.0 SP14 Patch02.
- Remove all SAP NetWeaver Developer Traces and archives of traces with severity Path or higher.
- Change the affected credentials because the logs could have already been read.
The disclosed information can only be accessed by authenticated users with high privileges (J2EE administrator), but they can escalate their privileges to other systems.
Available fix and Supported packages
- VCM | 3.00 | 3.00
- VCM LVM 3.0 | SP014 | 000002
Affected component
- BC-VCM-LVM
Landscape Virtualization Management
CVSS
Score: 8.7
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2903743
