Medium priority
SAP security note 1661752, "Potential information disclosure relating to queries", is a note released on June 12, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information related to server configurations using LOD-EOS-AS. This information could be leveraged to tailor more sophisticated attacks against systems utilizing LOD-EOS-AS.
Exposure of configuration data may allow attackers to gain insights into the system’s setup, potentially facilitating targeted malicious activities within SAP Sourcing environments.
Solution
SAP has released fixes in the following versions:
- Version 5.0 J
- Version 5.1 Patch 10
- All Version 7.0 SP and patch releases
To mitigate this vulnerability, update to the appropriate release or patch level as specified.
Affected components
- ESOUSRMJAVASERVER: Versions 5.0 and 5.1
Full note on SAP: SAP Support Launchpad note 1661752
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].