https://insinuator.net/tags/erp/ Recent content in ERP on Insinuator.net - Bold Statements Hugo en-us Thu, 30 Jun 2016 00:00:00 +0000 https://insinuator.net/2016/06/some-infos-about-sap-security-note-2258786/ Thu, 30 Jun 2016 00:00:00 +0000 https://insinuator.net/2016/06/some-infos-about-sap-security-note-2258786/ <p>On the 8th of March SAP released the security note for a vulnerability we reported during an assessment of a SAP landscape. The issue affects the SAP NetWeaver Web Administration Interface.  By knowing a special URL a malicious user can acquire version information about the services enabled in the SAP system as well as the operating system used.  We wanted to share some details on the issue.</p> <p>The vulnerability is a bypass of the HTTP Basic Authorization for the <a href="https://help.sap.com/saphelp_nw73/helpdata/en/4b/c1cd5cfb0050e9e10000000a15822b/content.htm?frameset=/en/48/3e191a252f72d0e10000000a42189c/frameset.htm&amp;current_toc=/en/62/d678c5330a4992bc6fe927e6137c9d/plain.htm&amp;node_id=155&amp;show_children=false">SAP Web Administration Interface</a>. It discloses version information about the system respectively operating system, a brief SAP patch level overview and running services including their corresponding ports.</p>