SAP Security Note
High priority
SAP security note 1854826, "Potential information disclosure for NetWeaver web sessions", is a program error note released on 08.10.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to NetWeaver browser sessions (cookies) that is used to identify and authenticate the user. The information an attacker can get does not enable access to an affected NetWeaver system directly, but it would help in other attacks, e.g., to verify user/password combinations.
Solution
Install an updated version of the affected software component.
Reason and prerequisites
Using malicious links, customers could be tricked into starting a browser session that sends some client data (cookies) back to the attacker. The links could also be used by an attacker to test user/password combinations they may have obtained elsewhere.
CVSS
Score 4.3 Vector: AV:N/AC:M/AU:N/C:P/I:N/A:N
Affected components
- DI_CLIENTS 7.11
- DI_CLIENTS 7.20
- DI_CLIENTS 7.30
- DI_CLIENTS 7.31
- DI_CLIENTS 7.40
Full note on SAP: SAP Support Launchpad note 1854826
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
