Mariano Nuñez Di Croce has reported a vulnerability in SAP JAVA CORE, which can be exploited by malicious people to conduct phishing attacks.

The vulnerability is caused due to an unspecified error within the authentication mechanism of the SAP J2EE engine, which can be exploited to conduct phishing attacks by e.g. sending specially crafted emails to the users of a vulnerable system.

The vulnerability is reported in:
* SAP JAVA CORE 6.40 prior to SP26
* SAP JAVA CORE 7.00 prior to SP02
* SAP JAVA CORE 7.01 prior to SP07
* SAP JAVA CORE 7.02 prior to SP03

Solution
Patches are available via SAP Note 1175239.
Further details available in Customer Area

Provided and/or discovered by
Mariano Nuñez Di Croce, Onapsis

Original Advisory
Onapsis:
http://archives.neohapsis.com/archives/fulldisclosure/2010-02/0215.html

SAP Note 1175239:
https://service.sap.com/sap/support/notes/1175239

Deep Links
Links available in Customer Area