Security Note CRM Middleware, SAP security note 1493260

SAP security note 1493260, "Security Note: CRM Middleware". Below are the symptom and SAP recommended solution.

Description

Symptom

A malicious user can fetch information relating to CRM Middleware. Furthermore, CRM Middleware can be exploited by a malicious user to display or modify application content without authorization and to potentially obtain authentication information of other legitimate users.

Solution

Apply this note via Note Assistant (SNOTE).

Reason and prerequisites

The code can be exploited by a malicious user to display, create, modify, or delete data. In such cases, the availability and data confidentiality of the system can be endangered.

These identified source code lines belong to the CRM Middleware tools like Admin Console, Generation Workbench, and other developer tools. The source code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve or change data from the database. This note is introduced to remove any such SQL vulnerability in CRM Middleware code lines.

References

• 1526457 – Missing Authorization Check and Info Disclosure in CRM MW