Unauthorized use of application functions in WEBCUIF and CRMUIF, SAP security note 2221082

SAP security note 2221082, “Unauthorized use of application functions in WEBCUIF and CRMUIF”. Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in WEBCUIF and CRMUIF without authentication and authorization.

Solution

Please implement the attached correction instructions or the corresponding support packages.

Reason and prerequisites

WEBCUIF and CRMUIF execute certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. This can be achieved through cross-site scripting attacks or by presenting a malicious link to the victim.

CVSS

Score 6.8 Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P