SAP security note 1510360, "CRM marketing applets: Problems with icf/set_HTTPonly_flag", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
There are problems when you call the following CRM marketing applets:
- Segment Builder applet
- Calendar applet
- Campaign Automation applet
Solution
Implement the attached corrections provided in this SAP Note.
Reason and prerequisites
The security-relevant system profile parameter icf/set_HTTPonly_flag_on_cookies (icf/set_HTTPonly_flag_on_cookies = 0) is activated for the application server ABAP. This parameter sets the httpOnly flag for system cookies, preventing applets from accessing the cookies.
References
This note refers to
- SAP Note 1532777 – Collective Note: ABAP Session Protection Recommendations
Affected components
- BBPCRM (Versions 520, 600, 700, 701)
Full note on SAP: SAP Support Launchpad note 1510360
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].