SAP security note 1177797, "Potential information disclosure relating to FlexUI". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can discover information relating to the FlexUI application. This information could be used to allow the malicious user to specialize their attacks against FlexUI.
Solution
After applying the patches listed below, no information can be discovered anymore.
There is no workaround possible.
Reason and prerequisites
Information such as runtime environment details can be discovered using FlexUI. This information may be used by a malicious user to further target FlexUI.
References
Affected components
- SAP NetWeaver 6.40 up to SP 23
- SAP NetWeaver 7.0 (formally named 2004s) up to SP 018
- SAP EHP1 for SAP NetWeaver 7.0 up to SP3
Full note on SAP: SAP Support Launchpad note 1177797
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
