SAP NetWeaver flaw spews user tables

Russian security researchers have reported a vulnerability in SAP NetWeaver which could allow attackers to gain access to Central User Administration tables.

Details on the vulnerability (CVE-2014-3787) in the service-oriented and integration platform were kept under wraps by security firm PT Security which conducted regular tests on SAP kit.

The Central User Administration feature streamlined management of multiple users accounts that were managed on different clients. SAP was among the most popular business applications and was used by three quarters of Forbes 500 companies.

Dmitry Gutsko said the sensitive information disclosure vulnerability affected NetWeaver versions 7.20 and earlier.

"By successfully exploiting the vulnerability, an attacker can read any tables from SAP Central User Administration via accessing the affiliated system, which may lead to disclosure of user data stored in all CUA systems," Gutso said in a disclosure.

Users were advised to apply the latest NetWeaver security patches to fix the flaw.

SAP users were notorious bad at updating and securing their deployments. Last year ERP Scan founder Alexander Polyakov found hundreds of organisations ran vulnerable and old versions of SAP and had exposed deployments to the public internet.

Polyakov found many customers ran versions of NetWeaver j2EE that contained critical holes that allowed attackers to execute commands without authentication.

And in January this year the security company reported a critical XML External Entity (XXE) vulnerability within SAP NetWeaver's GRMGApp which was open to unauthorised access. ®