SAP security note 1624836, “Verb Tampering issues in Web Services”, is a program error note released on 11.10.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Problems with authorization and authentication checks in conjunction with different HTTP methods used might exist in Web Services.
Solution
Apply the patches in the note according to the used version and Service Pack level.
Reason and prerequisites
Web Services might contain Verb Tampering vulnerabilities. This means that there is a risk of information disclosure and/or data tampering if the application is accessed with HTTP requests containing unexpected HTTP methods.
Affected components
- J2EE-APPS 7.10 to 7.11
- J2EE-APPS 7.20
- J2EE-APPS 7.30
- J2EE-APPS 7.31
Full note on SAP: SAP Support Launchpad note 1624836
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].