SAP Netweaver Insecure SAPTerm User Account Creation Security Bypass Vulnerability

Bugtraq ID:	48509
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jun 30 2011 12:00AM
Updated:	Jun 30 2011 12:00AM
Credit:	Julius von dem Bussche
Vulnerable:	SAP NetWeaver 7.30 SAP NetWeaver 7.10 SAP NetWeaver 7.02 SAP NetWeaver 7.01 SAP NetWeaver 7.0
Not Vulnerable:

SAP Netweaver Insecure SAPTerm User Account Creation Security Bypass Vulnerability

SAP Netweaver is prone to a security-bypass vulnerability that can allow a user to create insecure SAPTerm user accounts.

Attackers can exploit this issue to perform certain unauthorized actions. This may aid in further attacks.

SAP Netweaver Insecure SAPTerm User Account Creation Security Bypass Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]

SAP Netweaver Insecure SAPTerm User Account Creation Security Bypass Vulnerability

Solution:
The vendor has released an update. Please see the references for more information.

SAP Netweaver Insecure SAPTerm User Account Creation Security Bypass Vulnerability

References:

• SAP NetWeaver Fixes (SAP)
  
• SAP NetWeaver Homepage (SAP)