SAP security note 1310245, “WD Client Java Logon Issue”, is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
A security issue was found in the portal’s WD Java client to run WD Java applications.
If the password for ‘administrator’ is set to ‘abc123’, users of the Web Dynpro Java client may connect unintentionally, in certain system configurations, to the Web Dynpro back end when using the ‘administrator’ account.
Solution
Make sure that your ‘administrator’ account uses a strong password and never a commonly used one, such as ‘abc123’, or apply the indicated Support Packages (SPs). This issue will be fixed in the following versions:
- NW04s 645 SP19 and above
- NW04s 701 SP04 and above
Full note on SAP: SAP Support Launchpad note 1310245
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
