Description
Exploiting weak/predictable user credentials is one of the most common and successful attack scenarios used against SAP systems. During the installation, SAP systems create the standard users SAP*, DDIC and EARLYWATCH. Acunetix WVS tried the default passwords for these standard users (and other commonly used SAP users) and managed to guess a set of credentials that were accepted by the SAP system.
Remediation
To protect standard SAP users from unauthorized use:
- Define a new superuser and deactivate SAP*.
- Change all of the default passwords for these users.
References
Related Vulnerabilities
WordPress 4.0.x Multiple Vulnerabilities (4.0 - 4.0.36)
WordPress Plugin WP CSS 'wp-css-compress.php' Local File Disclosure (2.0.5)
GraphQL Unhandled Error Leakage
PrestaShop Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2018-5682)
WordPress Plugin WP SlackSync Information Disclosure (1.8.5)