SAP Security Note
High priority
SAP security note 1675232, "Unauthorized modification in BSP in CRM-IC-CAM", is a program error note released on 08.05.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The BSP Page CRMCMP_CMP_MKT CMPMKTDETAILOV.HTM within CRM-IC-CAM does not sufficiently encode output parameters, resulting in a cross-site scripting (XSS) vulnerability. This flaw can be exploited to steal another user’s authentication information, such as data related to their current session. An attacker who gains access to this data may impersonate the user and access all information with the same privileges as the target user. If an administrator is impersonated, the security of the entire application may be fully compromised.
Solution
Please apply this note or import the changes via the relevant support package.
CVSS
Score 0
References
- BSP: Design2008 for release 7.00 and 7.01
- ABAP XSS Escaping Support
- Security options (XSS) for ESCAPE
Affected components
- BBPCRM 520
- BBPCRM 600
- BBPCRM 700
- BBPCRM 701
- BBPCRM 702
- BBPCRM 712
Full note on SAP: SAP Support Launchpad note 1675232
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
