Skip links

BEx Web Removing DEBUG=X parameter for non-admin users, SAP security note 1542355

Description

You have used BEx URL parameter DEBUG=X to analyze command processing of BEx Web Applications. This parameter was influencing the processing by adding additional debug messages with information which could be used for analysis of the commands (eg. path statements processing)
Incorrect behaviorSome internal information was given to the user. Such information, even
if not giving any data to the user, could be incorrectly used for analysis of the system behavior.

Available fix and Supported packages

  • BI-BASE-S | 7.00 | 7.02
  • BI-BASE-S | 7.30 | 7.30
  • SAP_BW | 700 | 702
  • SAP_BW | 711 | 711
  • HM-BI-BASE-S | 7.00 | 7.02
  • HM-BIWEBAPP | 7.00 | 7.02
  • BIWEBAPP | 7.00 | 7.02
  • BIWEBAPP | 7.30 | 7.30
  • BI BASE SERVICES 7.00 | SP024 | 000000
  • BI BASE SERVICES 7.01 | SP009 | 000000
  • BI BASE SERVICES 7.30 | SP005 | 000000
  • BI WEB APPLICATIONS 7.00 | SP024 | 000000
  • BI WEB APPLICATIONS 7.01 | SP009 | 000000
  • BI WEB APPLICATIONS 7.30 | SP005 | 000000

Affected component

    BW-BEX-ET-WJR-RT
    Web Runtime and API commands

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1542355

TAGS

#debug
#debugging
#analysis-of-PATH-statements