SAP security note 1329090, "Security Note: Deactivate parameter sap-wd-ssrConsole", is a note. Below are the symptom, SAP recommended solution, reason and prerequisites, CVSS rating and the affected software components.
Description
Symptom
The parameter sap-wd-ssrConsole is always available.
Solution
By implementing the attached correction instructions, the parameter becomes available only if the application user has debugging authorizations (see authorization object S_DEVELOP). If the user is not authorized, the system does not react.
Reason and prerequisites
This is caused by a program error. It occurs only in NetWeaver Releases 700 and 710. In subsequent releases (EhPs), the problem has been solved.
CVSS
Score 0
References
This note refers to
Affected components
- SAP_BASIS 700
- SAP_BASIS 710
Full note on SAP: SAP Support Launchpad note 1329090
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
