Description
SAP FI Manager Self-Service has a hard-coded user name, which makes it easier for remote attackers to obtain access via unspecified vectors.
References
- https://service.sap.com/sap/support/notes/1929473
- http://www.onapsis.com/resources/get.php?resid=adv_onapsis-2014-024
- 68951 vdb-entry
- 20140729 [Onapsis Security Advisory 2014-024] Hard-coded Username in SAP FI Manager Self-Service mailing-list
- 20140729 [Onapsis Security Advisory 2014-024] Hard-coded Username in SAP FI Manager Self-Service mailing-list
- 59605 third-party-advisory
- sap-fimanager-default-account(94923) vdb-entry
- http://scn.sap.com/docs/DOC-8218
- http://packetstormsecurity.com/files/127669/SAP-FI-Manager-Self-Service-Hardcoded-Username.html