SAP Security Note
Medium priority
SAP security note 1587361, “Verb tampering issues in NWA applications”, is a program error note released on 11.10.2011. Below are the symptom, SAP recommended solution, CVSS assessment, references and the affected software components.
Description
Symptom
Problems with authorization and authentication checks in conjunction with different HTTP methods used might exist in NetWeaver Admin applications.
Solution
Apply the appropriate patch for your release from the Service Marketplace.
Reason and prerequisites
NetWeaver Admin core applications (system info, DSR, App tracing) might contain Verb Tampering vulnerabilities. This means that there is a risk of information disclosure and/or data tampering if the application is accessed with HTTP requests containing unexpected HTTP methods.
CVSS
Score 0
References
This note refers to
Affected components
- LM-CORE 7.10 to 7.11
- LM-CORE 7.20
- LM-CORE 7.30
- SAP-JEE 6.40
- SAP_JTECHS 6.40
- SAP_JTECHS 7.00 to 7.02
Full note on SAP: SAP Support Launchpad note 1587361
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].