SAP security note 1538218, “Potential information disclosure relating to security by WDA”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can discover information relating to user IDs of a user. This information could be used to allow the malicious user to specialize their attacks against the user.
Solution
Implement the correction instructions provided, or import the relevant Support Package.
Reason and prerequisites
Information such as user IDs can be discovered using Web Dynpro ABAP. This information may be used by a malicious user to specialize their attacks against the user.
Affected components
- Basis Components > Web Dynpro > Web Dynpro ABAP > Web Dynpro ABAP Runtime
Full note on SAP: SAP Support Launchpad note 1538218
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].