SAP security note 1552298, "Update #1 to Security Note 1475075". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Correction instructions for the vulnerability described in Security Note 1475075 (possible access to and changing of data in the Solution Manager) have to be corrected for the following releases:
- 7.0 Support Package 20 to 26
The corrected instructions are attached to this note.
Solution
The correction in Note 1475075 requires a subsequent correction in some rare cases.
- For Support Packages 20 to 24: First execute the solution from Note 1475075. Then implement the correction instructions contained in this note.
- Support Packages 25 and 26: Already contain the correction from Note 1475075. Therefore, only implement the correction instructions from this note for these two Support Packages.
Reason and prerequisites
The correction instructions in Security Note 1475075 are incorrect and require a correction.
References
This note refers to
Affected components
- ST 400
Full note on SAP: SAP Support Launchpad note 1552298
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].