SAP Security Note
High priority
SAP security note 2256846, "Potential information disclosure relating to usernames", is a program error note released on 09.02.2016. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can discover information relating to usernames who use the UWL People Picker. This information could be exploited to target specific usernames and the UWL People Picker functionality.
Solution
Update your UWL to a Support Package or release where the issue is fixed.
Reason and prerequisites
Information such as usernames can be discovered using the UWL People Picker. This can enable an attacker to further target the NetWeaver AS Java environment.
CVSS
Score 5.0 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N
References
Affected components
- UWLJWF: Versions 7.00 to 7.02
- JWF: Versions 7.30, 7.31, 7.40, 7.50
Full note on SAP: SAP Support Launchpad note 2256846
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
