Advisory
On 11.03.2025 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within Kernel.
SAP Note 3558132 addresses "[CVE-2025-0071] Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager" to prevent additional authorization check with a medium risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Risk specification
SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impact on integrity or availability.Solution
SAP Web Dispatcher and Internet Communication Manager do not longer expose sensitive information. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "n.a.".
The advisory is valid for
- KERNEL 7.53 43
- KERNEL 7.54 22
- KERNEL 7.77 42
- KERNEL 7.89 24
- KERNEL 7.93 18
- KERNEL 9.14 4
- KRNL64UC 7.53 43
- WEBDISP 7.53 16
- WEBDISP 7.54 8
- WEBDISP 7.77 16
- WEBDISP 7.89 9
- WEBDISP 7.93 5
