Low priority
SAP security note 1667388, “Explicit Scope Declaration issues in BRMS-CORE”, is a program error note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
In BRMS-CORE, there are issues with the explicit scope declaration of fields, methods, and classes. Classes, methods, and variables without explicit public, private, or protected labels are accessible within the same package, posing significant security risks. An attacker could introduce a new class into the package and access elements that were intended to be hidden.
Solution
Apply the appropriate patch matching your support package version as listed below. Follow the instructions in the NetWeaver Support Package Stack Guide to ensure correct installation.
Affected components
- BRMS-CORE Versions: 7.20, 7.30, 7.31
Full note on SAP: SAP Support Launchpad note 1667388
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].