SAP security note 1611873, "Verb Tampering Issues in CM Services". Below are the symptom and SAP recommended solution.
Description
Symptom
Problems with authorization and authentication checks may exist in CM Services due to the use of different HTTP methods, potentially allowing verb tampering.
Solution
Apply the appropriate patch attached to this note based on your AS Java hosting CM Services release and support package level:
- For 7.0x releases: The fix is included in software component
LM-TOOLS. - For 7.20, 7.30, and later: The fix is included in software component
LM-CTS.
You can download the patch for SNOTE or access the PDF version.
Reason and prerequisites
CM Services might contain verb tampering vulnerabilities, posing risks of information disclosure and data tampering when accessed with unexpected HTTP methods. To mitigate these risks:
- Ensure that SAP Note 1445998 is applied to disable the invoker servlet.
- Both SAP Note 1611873 and SAP Note 1445998 must be applied to fully protect against attacks through servlets of this component.
CVSS
Score 0
References
Full note on SAP: SAP Support Launchpad note 1611873
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].