SAP Security Note
SAP security note 1854408, "Potential Information Disclosure Relating to User Password", released on 12-Nov-2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to user and password that is generated by access requests. This information could be used to allow the attacker to specialize their attacks against plugin connectors and the GRC system.
Solution
Implement the attached correction instructions. This note contains design changes related to user password provisioning, so it is recommended to implement it cautiously and conduct intensive regression testing before moving to production.
Reason and prerequisites
Information such as user passwords can be discovered using GRC. This information may be used by an attacker to further target plugin connectors.
CVSS
Score 4.0 Vector: AV:N/AC:L/AU:S/C:P/I:N/A:N
References
Affected components
- GRCFND_A V1000
- GRCFND_A V1100
- GRCFND_A V8000
Full note on SAP: SAP Support Launchpad note 1854408
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
