SAP security note 1822847, “Potential information disclosure in PI”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to passwords, which are used in PI Directory Configuration. This information could be used to allow attackers to specialize their attacks against Process Integration Directory configuration.
Solution
This is fixed with the Support Packages and Patches of the Software Components referenced by this note in the section ‘Support Package Patches’.
Reason and prerequisites
Information such as passwords can be discovered using PI Directory. This information may be used by an attacker to further target PI.
CVSS
Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N
References
This note refers to
Affected components
- MESSAGING: 7.10
- SAP_XIGUI: 7.11
- SAP_XIGUILIB: 7.20, 7.30, 7.31, 7.40
Full note on SAP: SAP Support Launchpad note 1822847
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].