Vahagn Vardanian

Co-founder and CTO of RedRays

May 11, 2010
12:00 am

Information obtainable about Web Dynpro ABAP applications, SAP security note 1442498

SAP Note 1442498
SAP Security Note
Medium priority

SAP security note 1442498, "Information obtainable about Web Dynpro ABAP applications", is a program error note released on 11.05.2010. Below are the symptom, SAP recommended solution and the affected software components.

ComponentBasis Components > Web Dynpro > Web Dynpro ABAP > Web Dynpro ABAP Runtime

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version1

StatusReleased for Customer

Released on11.05.2010

LanguageEnglish

Description

Symptom

You can obtain information in a system as to which Web Dynpro ABAP applications exist or do not exist.

Solution

Implement the relevant correction instructions or import the relevant Support Package.

Reason and prerequisites

This problem is caused by a program error.

CVSS

Score 0

References

This note refers to

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Referenced by

888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

SAP_BASIS: 700 to 702, 710 to 720

Full note on SAP: SAP Support Launchpad note 1442498

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Web #Dynpro #ABAP #Runtime

Explore More

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.

SAP Note 3758900: Code Injection in SAP MII (CVE-2026-44758)

August 11, 2026

CVE-2026-44758, CVSS 9.1: the SAP MII IllumXSLTServlet compiled a caller supplied stylesheet. SAP removed the endpoint rather than patching it.

SAP Note 3759854: Directory Traversal in SAP MII (CVE-2026-44763)

August 11, 2026

CVE-2026-44763, CVSS 7.6: a save path in the SAP MII SSCE interface was assembled without containment, letting files land outside the intended folder.

SAP Note 3758657: Scheduling Authorization Gap, SAP MII (CVE-2026-44765)

August 11, 2026

CVE-2026-44765, CVSS 7.3: SAP MII scheduling functions were reachable without an authorization check. The fix adds guards and new role assignments.