Security Note Portal user credentials at risk, SAP security note 1138416

SAP security note 1138416, “Security Note: Portal user credentials at risk”. Below are the symptom and SAP recommended solution.

Description

Symptom

This security vulnerability is relevant if you have installed SAP NetWeaver CE 7.1 SP4 (with patch level 0 only).

Solution

• Upgrade: This issue is fixed in versions higher than NWCE 7.1 SP4. It is recommended to upgrade to NWCE 7.1 SP4 PL#1 or later.
• Patch Deployment: Deploy the attached SDA File on your system to resolve the vulnerability.
• Mitigation: Implementing encryption using SSL will help mitigate the risk of credential exposure.

Reason and prerequisites

Under certain circumstances, portal user credentials can be discovered by unauthorized users, posing a significant security risk.

References

• SAP Note 1253774: SAP NetWeaver CE Portal Platform NW7.1, SP5/SR5
• SAP Note 1174044: SAP NetWeaver CE Portal Platform NW7.1 EhP1 SP1 Known Issues
• SAP Note 1051630: Central Note: Portal General Issues for NetWeaver CE 7.1