Description
SAP Internet Communication Framework (ICF) is enabled and the info service can be accessed anonymously through the /sap/public/info URL. This service leaks sensitive information about the SAP platform, such as operating system version, SAP version, IP address and other information.
Remediation
It's recommended to restrict access to the ICF service (if not used inside the organization). The ICF service can be deactivated using the SICF transaction.
References
Related Vulnerabilities
Axis development mode enabled in WEB-INF/server-config.wsdd
Python Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-1015)
WordPress Plugin Wholesale Market for WooCommerce Arbitrary File Download (1.0.6)
WordPress Plugin DZS Video Gallery Information Disclosure (3.1.3)
WordPress Plugin Be POPIA Compliant Information Disclosure (1.1.5)