SAP Web Application Server Remote Information Disclosure Vulnerability

Bugtraq ID:	20877
Class:	Design Error
CVE:	CVE-2006-5784
Remote:	Yes
Local:	No
Published:	Nov 02 2006 12:00AM
Updated:	Feb 08 2007 11:18PM
Credit:	Nicob is credited with the discovery of this vulnerability.
Vulnerable:	SAP Web Application Server 7.0 SAP Web Application Server 6.40
Not Vulnerable:

SAP Web Application Server Remote Information Disclosure Vulnerability

SAP Web Application Server is prone to a remote information-disclosure vulnerability.

An attacker can leverage this issue to gain access to sensitive data. Information obtained could aid in further attacks.

These versions are affected:

- 6.40 patch 135 and prior
- 7.00 patch 55 and prior.

SAP Web Application Server Remote Information Disclosure Vulnerability

Sample exploit code has been provided:

• /data/vulnerabilities/exploits/20877.pl

SAP Web Application Server Remote Information Disclosure Vulnerability

Solution:
The vendor has released fixes to address this issue. Please see the references for more information.

SAP Web Application Server Remote Information Disclosure Vulnerability

References:

• SAP Homepage (SAP)
  
• Multiple vulnerabilities in SAP Web Application Server (Nicob)
  
• Multiple vulnerabilities in SAP WebAS 6.40 and 7.00 (technical details) (Nicob )
  
• Re: Multiple vulnerabilities in SAP Web Application Server 6.40 and7.00 (Nicob )