Description
The SAP Management Console in SAP NetWeaver 7.40 allows remote attackers to obtain sensitive information via the ReadProfile parameters, aka SAP Security Note 2091768.
References
- http://packetstormsecurity.com/files/132359/SAP-Management-Console-Information-Disclosure.html
- https://erpscan.io/advisories/erpscan-15-007-sap-management-console-readprofile-parameters-information-disclosure/
- 73705 vdb-entry
- 20150625 [ERPSCAN-15-007] SAP Management Console ReadProfile Parameters - Information disclosure mailing-list
- 20150623 ERPSCAN Research Advisory [ERPSCAN-15-007] SAP Management Console ReadProfile Parameters - Information disclosure mailing-list