SAP security note 1662220, "Potential information disclosure relating to cached process". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to the local cache in systems using LOD-ESO-AS. This information could be used to allow the attacker to specialize their attacks against LOD-ESO-AS.
Solution
Fixes have been developed and released in:
- Version 5.0 J
- Version 5.1 Patch 10
- All Version 7.0 SP and patch releases
Reason and prerequisites
Information such as configuration data can be discovered using LOD-ESO-AS. This information may be used by an attacker to further target SAP Sourcing.
Affected components
- ESOUSRMJAVASERVER from 5.0 to 5.0
- ESOUSRMJAVASERVER from 5.1 to 5.1
Full note on SAP: SAP Support Launchpad note 1662220
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
