Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Unauthorized use of appl. functions in CRM-MKT-MPL-CA-BRE, SAP security note 1591484

SAP Note 1591484
High priority

SAP security note 1591484, "Unauthorized use of Application Functions in CRM-MKT-MPL-CA-BRE", is a program error note released on 08.11.2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentCRM-MKT-MPL-CA-BRE
CategoryProgram error
PriorityCorrection with high priority
StatusReleased for Customer
Released on08.11.2011

Description

Symptom

A malicious user can execute functions in CRM-MKT-MPL-CA-BRE without authentication and authorization.

Solution

  • Prerequisites: Refer to SAP Note 1520324 and SAP Note 1551982 for additional information and instructions. The corrections from these notes are prerequisites for implementing this note.
  • Implement Correction Instructions: Follow the correction instructions provided in this note. This will create the report BSP_XSRF_PARAM_CRM_MKT_CA in your system.
  • Execute the Report: Run the report BSP_XSRF_PARAM_CRM_MKT_CA and specify a corresponding transport request number when prompted. This will activate the XSRF protection for the BSP applications adapted by this note.

Affected components

  • CRM-MKT-MPL-CA-BRE versions 500, 520, 600, 700, 701

Full note on SAP: SAP Support Launchpad note 1591484

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#CRM-MKT-MPL-CA-BRE #Authentication Bypass #Authorization Bypass #SAP CRM

Explore More