Unauthorized use of application functions in CRM-MKT-MPL, SAP security note 1593110

Description

A malicious user can execute functions in CRM-MKT-MPL without authentication and authorization.

Available fix and Supported packages

BBPCRM | 500 | 500
BBPCRM | 520 | 520
BBPCRM | 600 | 600
BBPCRM | 700 | 700
BBPCRM | 701 | 701
BBPCRM 520 | SAPKU52011 |
BBPCRM 500 | SAPKU50020 |
BBPCRM 600 | SAPKU60011 |
BBPCRM 700 | SAPKU70011 |
BBPCRM 701 | SAPKU70107 |

Affected component

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1593110

TAGS

#Cross-site-request-forgery
#XSRF
#CRM-MKT-MPL

Explore More

SAP Security Patch Day – July 2025

July 9, 2025

On July 8, 2025, SAP released its monthly security updates affecting 27 components. This month includes 5 HotNews notes (CVSS ≥ 9.0)

Registration Open: SAP Security Training – August 2025 | Limited Seats

June 20, 2025

Discover vulnerabilities through the eyes of an attacker In today’s digital landscape, SAP systems form the backbone of critical business operations for

[PoC][CVE-2025-25243] Path Traversal Vulnerability in SAP SRM

June 20, 2025

Advisory ID: REDRAYS-2025-091 CVE ID: CVE-2025-25243 Severity: High (CVSS v3.0: 8.6/10) Affected Product: SAP Supplier Relationship Management (Master Data Management Catalog) Publication

SAP Security Patch Day – June 2025

June 10, 2025

On June 10, 2025, SAP released its monthly Security Patch Day updates, addressing 14 new vulnerabilities across various SAP products and components.

Vahagn Vardanian