Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Unauthorized modification of displayed content in CRM_MKT, SAP security note 1698421

SAP Note 1698421
High priority

SAP security note 1698421, “Unauthorized Modification of Displayed Content in CRM_MKT”, is a program error note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.

ComponentCustomer Relationship Management > Marketing > Segmentation > Target Groups (CRM-MKT-SEG-TGR)
CategoryProgram error
PriorityCorrection with high priority
StatusReleased for Customer
Released onMay 8, 2012

Description

Symptom

Attackers can exploit insufficient encoding of GUID parameters in BSP pages within CRM_MKTTG_SEGAP and SEGED_TG to execute reflected XSS attacks. This can lead to non-permanent defacement or modification of web content and the theft of user session data.

Solution

To mitigate this vulnerability, implement SAP Security Note 1698421 by downloading and applying the necessary patches.

Affected components

  • BBPCRM 500
  • BBPCRM 520
  • BBPCRM 600
  • BBPCRM 700
  • BBPCRM 701
  • BBPCRM 702
  • BBPCRM 712

Full note on SAP: SAP Support Launchpad note 1698421

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Reflected cross-site scripting #XSS #CRM-MKT-SEG-TGR

Explore More