SAP security note 2054566, “Potential disclosure of user information”, is a program error note released on 09.09.2014. Below is the security information published by SAP for this note.
Description
Symptom
An attacker can access information related to users. This information could be used to allow the attacker to specialize their attacks against on users and BC-BMT-WFM-DEF.
Reason and prerequisites
Information such as user passwords can be disclosed using BC-BMT-WFM-DEF. This information may be used by an attacker to further target users.
Solution
The involved test program has been disabled and can no longer be executed.
Full note on SAP: SAP Support Launchpad note 2054566
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
