CRM marketing applets Problems with icf/set_HTTPonly_flag, SAP security note 1510360

SAP Note 1510360SAP Security NoteHigh priority

SAP security note 1510360, "CRM marketing applets: Problems with icf/set_HTTPonly_flag", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.

ComponentCustomer Relationship Management > Marketing (CRM-MKT)

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released on14.12.2010

LanguageEnglish

Description

Symptom

There are problems when you call the following CRM marketing applets:

Segment Builder applet
Calendar applet
Campaign Automation applet

Solution

Implement the attached corrections provided in this SAP Note.

Reason and prerequisites

The security-relevant system profile parameter icf/set_HTTPonly_flag_on_cookies (icf/set_HTTPonly_flag_on_cookies = 0) is activated for the application server ABAP. This parameter sets the httpOnly flag for system cookies, preventing applets from accessing the cookies.

References

This note refers to

SAP Note 1532777 – Collective Note: ABAP Session Protection Recommendations

Affected components

BBPCRM (Versions 520, 600, 700, 701)

Full note on SAP: SAP Support Launchpad note 1510360

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Marketing #CRM-MKT #HTTPonly #Cookies