Potential information disclosure relating to PI Integration Directory, SAP security note 2174651

SAP Note 2174651
SAP Security Note
Medium priority

SAP security note 2174651, “Potential information disclosure relating to PI Integration Directory”, is a program error note released on 14.05.2024. Below are the symptom and SAP recommended solution.

ComponentBasis Components > NetWeaver Process Integration (PI) > Integration Builder – Configuration

CategoryProgram error

PriorityCorrection with medium priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on14.05.2024

LanguageEnglish

Description

Symptom

An attacker can discover information relating to PI Integration Directory. This information could be used to allow the attacker to specialize their attacks against SAP Process Integration.

Solution

This is fixed with the Support Packages and Patches referenced by this SAP Note.

Reason and prerequisites

Information such as user names and passwords can be discovered using PI Integration Directory. An attacker needs authenticated access to PI Integration Directory and change permission to exploit the vulnerability.

CVSS

Score 4.3 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Referenced by

2666057

Full note on SAP: SAP Support Launchpad note 2174651

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Information disclosure #SAP Process Integration #Integration Builder #NetWeaver PI