SAP NetWeaver Information Disclosure Vulnerability Allowing Credential Exposure

An information disclosure vulnerability has been identified in SAP NetWeaver. This issue arises from the injection of malicious instructions into user configuration settings. An attacker with administrative privileges can manipulate these settings to expose sensitive information, such as user credentials, when accessed by the victim. These credentials could then be used to gain unauthorized access to local or adjacent systems, significantly compromising confidentiality.

Impact

Exploitation of this vulnerability leads to unauthorized exposure of user credentials, which could be used to access local or adjacent systems.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP for Me platform, specifically during the SAP Security Patch Day, which occurs on the second Tuesday of each month.