Potential information disclosure relating to user/processes, SAP security note 1548848

SAP security note 1548848, "Potential information disclosure relating to user/processes", is released on September 13, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can discover information relating to user/processes who/which use NWBC for HTML. This information could be used to allow the malicious user to specialize their attacks against NWBC for HTML.

Information such as the user name and process identification can be discovered using NWBC for HTML. This information may be used by a malicious user to further target NWBC for HTML, potentially leading to more specialized and effective attacks.

Solution

Implement this security note to address and mitigate the potential information disclosure vulnerability.

References

• SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)