SAP Security Note
High priority
SAP security note 1912377, “Potential Session Reuse in CRM-ISA”, is a program error note released on 12.11.2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can be authenticated to CRM-ISA without having their own legitimate credentials by reusing an existing web session in the E-Commerce/Web Channel.
Solution
This note contains Java corrections for E-Commerce and Web Channel. Apply the Support Package patch level attached to this note.
Reason and prerequisites
An attacker with physical access to an unlocked user workstation with an active web session.
CVSS
Score 4.4 Vector: AV:L/AC:M/AU:N/C:P/I:P/A:P
References
- 1546959 – Patch strategies for SAP E-Commerce solutions
- 877887 – Installing Patches for CRM Java Components and FSCM BD
- 1934610 – Logon issues with Business-to-Business (B2B) web application
Full note on SAP: SAP Support Launchpad note 1912377
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].