Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing authentication in AS2 Adapter, SAP security note 1831932

SAP Note 1831932
SAP Security Note
High priority

SAP security note 1831932, "Missing authentication in AS2 Adapter", is a program error note released on 10.09.2013. Below are the symptom and SAP recommended solution.

ComponentBasis Components > NetWeaver Process Integration (PI) > Connectivity > B2B add-on (business-to-business) > Applicability Statement Protocol Adapter (BC-XI-CON-B2B-AS2)
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
StatusReleased for Customer
Released on10.09.2013
LanguageEnglish

Description

Symptom

A malicious user can execute functions in B2B AS2 Adapters without authentication.

Solution

This is fixed with the Support Packages and Patches of the Software Components referenced by this note in the section 'SP Patch Level'.

Reason and prerequisites

The vulnerability is caused by missing standard authentication and single sign-on mechanisms in a Java web servlet.

CVSS

Score 7.5 Vector: AV:N/AC:L/AU:N/C:P/I:P/A:P

Full note on SAP: SAP Support Launchpad note 1831932

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Missing credentials #B2B #AS2 Adapter

Explore More