A remote unauthenticated attacker can abuse a web service in SAP NetWeaver Application Server for Java (Administrator System Overview) versions 7.30 7.31 7.40 7.50 by sending a specially crafted XML file and trick the application server into leaking authentication credentials for its own SAP Management console resulting in Server-Side Request Forgery.