Skip links

Information Disclosure in SAP Landscape Management, SAP security note 2903743


A disclosure vulnerability exists in the enterprise edition or standard edition of SAP Landscape Management that would allow an authenticated user with high privilege to obtain privileged access to other systems making those other systems vulnerable to information disclosure and modification.

The information disclosed are the credentials. To fix the problem, proceed as follows:

  1. Implement SAP Landscape Management 3.0 SP14 Patch02.
  2. Remove all SAP NetWeaver Developer Traces and archives of traces with severity Path or higher.
  3. Change the affected credentials because the logs could have already been read.

The disclosed information can only be accessed by authenticated users with high privileges (J2EE administrator), but they can escalate their privileges to other systems.

Available fix and Supported packages

  • VCM | 3.00 | 3.00
  • VCM LVM 3.0 | SP014 | 000002

Affected component

    Landscape Virtualization Management


Score: 8.7


Exploit is not available.
For detailed information please contact the mail [email protected]