Potential information disclosure relating to CRM-ISA-BCS, SAP security note 1751800

SAP security note 1751800, “Potential information disclosure relating to CRM-ISA-BCS”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can discover information relating to users in CRM-ISA-BCS. This information could be used to allow the attacker to specialize their attacks against CRM-ISA-BCS.

Solution

This note contains Java correction(s) for E-Commerce and Web Channel.

• Apply the Support Package patch level attached to this note.
• For more information about applying Java patches, refer to Note 877887.
• See Note 1546959 for information about the patch strategy.

Reason and prerequisites

Information such as user IDs, first names, last names, and addresses can be discovered using CRM-ISA-BCS. This information may be used by an attacker to further target CRM-ISA-BCS.

CVSS

Score 5.8 Vector: AV:N/AC:M/AU:N/C:P/I:P/A:N

References

• Note 1546959 – Patch strategies for SAP E-Commerce solutions
• Note 877887 – Installing Patches for CRM Java Components and FSCM BD

Affected components

• SAP-CRMJAV (versions 6.0, 700, 701, 702, 730, 731, 732)
• SAP-CRMWEB (versions 6.0, 700, 701, 702, 730, 731, 732)
• SAP-SHRWEB (versions 6.0, 700, 701, 702, 730, 731, 732)
• SAP-SHRJAV (versions 6.0, 700, 701, 702, 730, 731, 732)
• SAP-CRMAPP (versions 6.0, 700, 701, 702, 730, 731, 732)
• SAP-SHRAPP (versions 6.0, 700, 701, 702, 730, 731, 732)