SAP security note 1677475, "Unauthorized use of application functions in HRRCF_START_EXT", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can execute functions in the HRRCF_START_EXT application without proper authentication and authorization. This vulnerability allows the execution of specific functions by tricking an authenticated user's browser into making requests with certain URLs and parameters. Methods to exploit this include cross-site scripting (XSS) attacks or by presenting malicious links to victims.
Solution
Apply the latest support packages to address this issue. Ensure that the following OSS notes are applied before implementing this security note: 1509014, 1520324, 1551982.
References
Affected components
- ERECRUIT 300, 600, 603, 604, 605, 606, 616
Full note on SAP: SAP Support Launchpad note 1677475
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
