SAP NetWeaver Enterprise Portal JNDI Injection Vulnerability Allowing Information Disclosure

A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL for JNDI lookups, potentially accessing unintended JNDI providers. This could lead to unauthorized disclosure or modification of server information, although it does not impact server availability.

Impact

Exploitation of this vulnerability could result in unauthorized access to JNDI providers, allowing for the disclosure or modification of sensitive server information.

Remediation

Users are advised to consult the SAP Security Notes for guidance on applying necessary patches. SAP Security Notes can be accessed through the SAP for Me platform, specifically on SAP Security Patch Days, which occur on the second Tuesday of each month.