SAP ICF /sap/public/info sensitive information disclosure
Description
SAP Internet Communication Framework (ICF) is enabled and the info service can be accessed anonymously through the /sap/public/info URL. This service leaks sensitive information about the SAP platform, such as operating system version, SAP version, IP address and other information.
Remediation
It's recommended to restrict access to the ICF service (if not used inside the organization). The ICF service can be deactivated using the <strong>SICF</strong> transaction.