CVE-2017-5372: Infoleak
The function msp (aka MSPRuntimeInterface) in the P4 SERVERCORE component in SAP AS JAVA allows remote attackers to obtain sensitive system information by leveraging a missing authorization check for the (1) getInformation, (2) getParameters, (3) getServiceInfo, (4) getStatistic, or (5) getClientStatistic function, aka SAP Security Note 2331908.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5372?
CVE-2017-5372 has been rated as a medium severity vulnerability due to the potential for information disclosure.
How do I fix CVE-2017-5372?
To fix CVE-2017-5372, ensure to apply the latest security patches from SAP for the NetWeaver AS JAVA component.
What types of sensitive information can be disclosed by CVE-2017-5372?
CVE-2017-5372 can disclose various sensitive system information including service statistics and runtime parameters.
Who is affected by CVE-2017-5372?
CVE-2017-5372 affects users of SAP NetWeaver AS JAVA who have not implemented necessary access controls.
Does CVE-2017-5372 require authentication to exploit?
CVE-2017-5372 can be exploited without authentication due to a missing authorization check.