Information Disclosure in SAP NetWeaver Mobile Client, SAP security note 2532802

SAP security note 2532802, "Information Disclosure in SAP NetWeaver Mobile Client". Below are the symptom and SAP recommended solution.

Description

Symptom

The database password was being saved in a properties file in plain text under the local directory of NetWeaver Mobile Client, allowing unauthorized access to the local database.

Solution

Code changes have been implemented to encrypt and store the database password using the Windows Certificate tool. The plain text password is no longer present in the defaults.properties file.

Please upgrade to at least the patch level specified in the Support Package Patches section of SAP Note 2532802.

Reason and prerequisites

Reason: The database password was being saved in a properties file under the local directory of NetWeaver Mobile Client in plain text.

Prerequisites: Using NetWeaver Mobile Client:

• Version 7.10 SP21 or below
• Version 7.11 SP16 or below
• Version 7.30 SP04 or below

CVSS

Score 3.5 / 10 Vector: AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N