SAP Security Note
Medium priority
SAP security note 1734308, "Potential information disclosure relating to BOE XI3.1 FP5.1", is a program error note released on 14.08.2012. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can discover information relating to business that they are not authorized to see. This vulnerability exists in BOE XI3.1 FP 5.1. The disclosed information could be used to enable the attacker to tailor their attacks against the company’s business operations.
Solution
Request an LAFix if you have already installed BOE XI3.1 FP 5.1. Alternatively, you can download and install BOE XI3.1 FP 5.2.
Reason and prerequisites
Information related to business operations can be discovered using BOE XI3.1 FP 5.1. This information may assist an attacker in further targeting the company’s business activities.
Full note on SAP: SAP Support Launchpad note 1734308
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].