SAP Note 1624092
SAP security note 1624092, “Missing authorization check in UDDI”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Problems with authorization and authentication checks in conjunction with different HTTP methods used might exist in UDDI.
Solution
Deploy the new patch of the UDDI sca.
Reason and prerequisites
UDDI might contain Verb Tampering vulnerabilities. This means that there is a risk of information disclosure and/or data tampering if the application is accessed with HTTP requests containing unexpected HTTP methods.
Affected components
- UDDI (versions 7.11 to 7.31)
Full note on SAP: SAP Support Launchpad note 1624092
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
