SAP security note 1438526, “SOA Error mapping in Enterprise Services”, is published by SAP for the affected component listed below. The description reproduces the information SAP released for this note.
Description
Certain error messages are so specific that they enable you to determine the dataset in a back-end system. This is not required.
Example: The error message ‘Instance & does not exist’ can be used maliciously.
The symptom described here can put the confidentiality of the dataset of a system at risk. However, the risk potential is very small.
CVSS
Score 0
Affected components
- ECC-SE | 501 | 501
- ECC-SE | 602 | 602
- ECC-SE | 603 | 603
- ECC-SE | 604 | 604
- ECC-SE | 605 | 605
- ECC-SE 501 | SAPK-50106INECCSE
- ECC-SE 603 | SAPK-60305INECCSE
- ECC-SE 604 | SAPK-60406INECCSE
- ECC-SE 605 | SAPK-60501INECCSE
- ECC-SE 602 | SAPK-60207INECCSE
- ECC-SE 603 | SAPK-60306INECCSE
- ECC-SE 604 | SAPK-60407INECCSE
- ECC-SE 605 | SAPK-60502INECCSE
Full note on SAP: SAP Support Launchpad note 1438526
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].