SAP security note 2101079, "Potential modification/disclosure of persisted data in BC-ESI-UDDI", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Update 14-Nov-2016: This note has been re-released with updated ‘Support Packages & Patches’ data.
An attacker can exploit BC-ESI-UDDI and use specially crafted inputs to modify database commands. This results in either the retrieval of additional information or the modification of data persisted by the system.
Solution
Code correction has been made to prevent such vulnerability issues.
Download and apply the patch according to your NetWeaver version and SP Level as described in the Download section of this Note.
Reason and prerequisites
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve additional data from the database or to modify the data.
CVSS
Score 6.8 / 10 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P
References
Affected components
- UDDI 7.11
- UDDI 7.20
- UDDI 7.30
- UDDI 7.31
- UDDI 7.40
- UDDI 7.50
Full note on SAP: SAP Support Launchpad note 2101079
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
