SAP security note 1625643, “Verb Tampering issues in BPEM-PP”, was released on 11.10.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Problems with authorization and authentication checks in conjunction with different HTTP methods used might exist in BPEM-PP.
Solution
To correct this problem, apply the patch matching your support package version as listed in the patch table below as per the instructions in the SAP NetWeaver Support Package Stack Guide.
Reason and prerequisites
BPEM-PP might contain Verb Tampering vulnerabilities. This means that there is a risk of information disclosure and/or data tampering if the application is accessed with HTTP requests containing unexpected HTTP methods.
Affected components
- BPEM-PP 7.11
- BPEM-PP 7.20
- BPEM-PP 7.30
- BPEM-PP 7.31
Full note on SAP: SAP Support Launchpad note 1625643
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
