SAP Web Dispatcher and Internet Communication Manager Password Exposure Vulnerability

A vulnerability exists in SAP Web Dispatcher and Internet Communication Manager that allows an attacker with administrative privileges to activate a debugging trace mode. This mode, when combined with a specific parameter value, reveals unencrypted passwords in the logs, thereby significantly compromising the application's confidentiality. However, there is no impact on the integrity or availability of the application.

Impact

Exposing unencrypted passwords in the logs, leading to a high confidentiality risk.

Remediation

Users are advised to review and implement the SAP Security Note related to this vulnerability, available through the SAP Security Patch Day Bulletin. For guidance on accessing and applying SAP Security Notes, refer to the SAP Security Notes FAQs.