Potential disclosure of persisted data, SAP security note 1502607

SAP security note 1502607, “SAP Note 1502607 – Potential disclosure of persisted data”, is a note. Below is the security information published by SAP for this note.

Description

A malicious user can exploit CRM Middleware and use specially crafted inputs to retrieve additional information persisted by the system.

Symptom

A malicious user can exploit CRM Middleware and use specially crafted inputs to retrieve additional information persisted by the system.

Reason and prerequisites

The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve data from the database.

Solution

Import the Support Package specified below.

If you want to implement the correction instructions, follow the manual steps.

References

• Note 1501685 – Table CRMATAB is empty
• Note 1499392 – Missing authorization check in CRM Middleware extractor
• Note 1498111 – No authorization for data selection in initial load