Potential information disclosure relating to CRM-ISA/CRM-ISE, SAP security note 1977754

SAP security note 1977754, "Potential information disclosure relating to CRM-ISA/CRM-ISE", was released on May 13, 2014. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can discover information relating to CRM-ISA/CRM-ISE WebChannel applications. This information could be used to allow the attacker to specialize their attacks against CRM-ISA/CRM-ISE WebChannel applications.

Solution

This note contains Java corrections for E-Commerce and Web Channel. Apply the Support Package patch level attached to this note.

For more information about applying Java patches, refer to Note 877887.

See Note 1546959 for information about the patch strategy.

Reason and prerequisites

Information such as the installed products, versions of those products, and user passwords can be discovered using WebChannel CRM-ISA/CRM-ISE. This information may be used by an attacker to further target WebChannel CRM-ISA/CRM-ISE.

CVSS

Score 5.0 Vector: AV:N/AC:L/AU:N/C:P/I:N/A:N