Hard-coded credentials in CRM-BTX-BF-FIN, SAP security note 1983739

SAP security note 1983739, "Hard-coded credentials in CRM-BTX-BF-FIN", is a program error note released on 08.04.2014. Below are the symptom, SAP recommended solution, affected software components and references.

Description

Symptom

CRM-BTX-BF-FIN contains code that changes the program's behavior when a user is successfully authenticated with a certain username.

An attacker can be authenticated to CRM-BTX-BF-FIN without having their own legitimate credentials, or they may escalate privileges.

Solution

Implement the attached correction instructions.

Reason and prerequisites

The program code contains a hard-coded username that changes the system's behavior if a user is successfully authenticated. The user may obtain additional information that should not be displayed.

The vulnerability is caused by a hard-coded username and password combination in the program's source code. An attacker who specifies these credentials can log on to the system without having been assigned legitimate access by the system administrator(s). If a user already has privileges with which they can log on, an escalation of privileges may be possible if the hard-coded account has higher access rights than the original user.

CVSS

Score 6.0 Vector: AV:N/AC:M/AU:S/C:P/I:P/A:P

References

Affected components

• BBPCRM: 500, 600, 700, 701, 702, 712, 713