SAP Security Note
Medium priority
SAP security note 1587362, "Verb tampering issues in NWA Stateview application", is a program error note released on 08.11.2011. Below are the symptom and SAP recommended solution.
Description
Symptom
Problems with authorization and authentication checks in conjunction with different HTTP methods used might exist in NetWeaver Admin Stateview application.
Solution
Apply patch for the respective release from Service Marketplace.
Reason and prerequisites
NetWeaver Admin Stateview application might contain Verb Tampering vulnerability. This means that there is a risk of information disclosure and/or data tampering if the application is accessed with HTTP requests containing unexpected HTTP methods.
Full note on SAP: SAP Support Launchpad note 1587362
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].