Skip links

Information Disclosure in SAP Landscape Management, SAP security note 2903743

Description

A disclosure vulnerability exists in the enterprise edition or standard edition of SAP Landscape Management that would allow an authenticated user with high privilege to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.

The information disclosed are the credentials. To fix the problem, proceed as follows:

  1. Implement SAP Landscape Management 3.0 SP14 Patch02.
  2. Remove all SAP NetWeaver Developer Traces and archives of traces with severity Path or higher.
  3. Change the affected credentials because the logs could have already been read.

The disclosed information can only be accessed by authenticated users with high privileges (J2EE administrator), but they can escalate their privileges to other systems.

Available fix and Supported packages

  • VCM | 3.00 | 3.00
  • VCM LVM 3.0 | SP014 | 000002

Affected component

    BC-VCM-LVM
    Landscape Virtualization Management

CVSS

Score: 8.7
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2903743

TAGS

#Information-Exposure
#Information-Leak
#LaMa
#LVM
#Provisioning