SAP Note 2819233
SAP security note 2819233, "Information Disclosure in Web Dynpro ABAP Applications", is a note released on 12.05.2020. Below are the symptom and SAP recommended solution.
Description
Symptom
Under certain conditions, Web Dynpro ABAP applications allow an attacker to access information about host names used with a web dispatcher, which would otherwise be restricted.
Impacts include:
- Loss of information and system configuration confidentiality
- Information gathering for further exploits and attacks
Solution
- Affected system components no longer reveal internal information to non-authenticated users.
- Implement the Support Packages and Patches referenced by this SAP Note.
- There is no known impact on existing functionalities after implementing the security note.
- Depending on the number of application servers for a specific system ID, the performance of specific WDA applications might reduce slightly.
Reason and prerequisites
Web Dynpro ABAP notification service is used.
CVSS
Score 5.3
Full note on SAP: SAP Support Launchpad note 2819233
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
