Potential information disclosure relating to user email, SAP security note 2069994

SAP security note 2069994, "Potential information disclosure relating to user email". Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can discover information relating to user email who uses BW-SYS-DB. This information could be used to allow the attacker to specialize their attacks against user emails in BW-SYS-DB.

Solution

To resolve this issue, apply the following Support Packages:

• SAP Business Warehouse (SAP BW) 7.0: Import Support Package 35 for SAP BW 7.00 (SAPKW70035) into your BW system. The Support Package is available once SAP Note 2009937 with the short text "SAPBWNews NW BW 7.0 ABAP SP35" is released for customers.
• SAP BW 7.01 (SAP BW 7.0 EHP 1): Import Support Package 18 for SAP BW 7.01 (SAPKW70118) into your BW system. The Support Package is available once SAP Note 2123573 with the short text "SAPBINews NW7.01 BW ABAP SP18" is released for customers.
• SAP BW 7.02 (SAP BW 7.0 EHP 2): Import Support Package 18 for SAP BW 7.02 (SAPKW70218) into your BW system. The Support Package is available once SAP Note 2126275 with the short text "Preliminary Version SAPBWNews NW BW 7.02 ABAP SP18" is released for customers.
• SAP BW 7.11: Import Support Package 14 for SAP BW 7.11 (SAPKW71115) into your BW system. The Support Package is available once SAP Note 1940531 with the short text "Preliminary Version SAPBINews NW7.11 BW ABAP SP15" is released for customers.
• SAP BW 7.30: Import Support Package 13 for SAP BW 7.30 (SAPKW73013) into your BW system. The Support Package is available once SAP Note 2021667 with the short text "SAPBWNews NW7.30 BW ABAP SP13" is released for customers.
• SAP BW 7.31 (SAP BW 7.3 EHP 1): Import Support Package 15 for SAP BW 7.31 (SAPKW73115) into your BW system. The Support Package is available once SAP Note 2070453 with the short text "Preliminary Version SAPBWNews NW BW 7.31/7.03 ABAP SP15" is released for customers.
• SAP BW 7.40: Import Support Package 10 for SAP BW 7.40 (SAPKW74010) into your BW system. The Support Package is available once SAP Note 2070452 with the short text "Preliminary Version SAPBWNews NW BW 7.4 ABAP SP10" is released for customers.

Reason and prerequisites

Information such as the installed products, versions of those products, and landscape configuration data can be discovered using BW. This information may be used by an attacker to further target user emails.