Potential information disclosure relating to processes, SAP security note 1507266

SAP security note 1507266, "Potential Information Disclosure Relating to Processes", is a program error note released on 11.10.2011. Below are the symptom and SAP recommended solution.

Description

Symptom

When working with Xcelsius dashboards that display BW data in the BEx runtime, exceptions can be raised. These exceptions were rendered as an HTML error page including stack trace information and presented to the user. This information could be used by malicious users to start specialized attacks.

Solution

The user will be shown a generic error message with a unique ID referring to a log entry that contains detailed error information. The log itself can only be accessed by privileged users. This way, a non-privileged user has no access to stack trace information.

Reason and prerequisites

An unexpected program error occurs and leads to an exception.

CVSS

Score 0