SAP security note 1474473, "BSP Application SRMSUS_LOGON unnecessary", is a program error note released on 10.08.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
BSP Application SRMSUS_LOGON can be deleted. The application was never in use and represented a potential threat when used for cross-site scripting attacks. In order to prevent such possible attacks, the application was deleted.
Solution
Import the corresponding support package or use transaction SE80 to delete the BSP Application SRMSUS_LOGON.
Reason and prerequisites
This is a program error caused by missing content validation for entered data when displaying it again. This vulnerability can be exploited if data is filled with scripting content to retrieve information that the user should not have access to.
Affected components
- SAP SRM 5.0
- SAP SRM 6.0
- SAP SRM 7.0
- SAP SRM 7.01
Full note on SAP: SAP Support Launchpad note 1474473
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].