Hard-coded credentials in CRM_BSP_ARC_1O, SAP security note 1496692

SAP Note 1496692
SAP Security Note
High priority

SAP security note 1496692, “Hard-coded credentials in CRM_BSP_ARC_1O”, is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and affected software components.

ComponentCRM-BTX – Customer Relationship Management > Business Transactions

CategoryProgram error

PriorityHigh priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released onDecember 14, 2010

LanguageEnglish

Description

Symptom

CRM_BSP_ARC_1O contains code that alters the program’s behavior when a user successfully authenticates with a specific username.

Solution

Implement the attached corrections provided in this SAP Note.

Reason and prerequisites

The program code includes a hard-coded username that changes the system’s behavior upon successful user authentication. This may allow the user to access additional information that should remain restricted.

Affected components

BBPCRM: 400, 500, 520, 600, 700, 701

Full note on SAP: SAP Support Launchpad note 1496692

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Backdoor #hard-coded #credentials #CRM_BSP_ARC_1O