SAP Security Note
High priority
SAP security note 1496692, “Hard-coded credentials in CRM_BSP_ARC_1O”, is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and affected software components.
Description
Symptom
CRM_BSP_ARC_1O contains code that alters the program’s behavior when a user successfully authenticates with a specific username.
Solution
Implement the attached corrections provided in this SAP Note.
Reason and prerequisites
The program code includes a hard-coded username that changes the system’s behavior upon successful user authentication. This may allow the user to access additional information that should remain restricted.
Affected components
- BBPCRM: 400, 500, 520, 600, 700, 701
Full note on SAP: SAP Support Launchpad note 1496692
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].