Unauthorized modification of BSP in CRM-MD-PRO-OBJ, SAP security note 1676849

SAP security note 1676849, “Unauthorized modification of BSP in CRM-MD-PRO-OBJ”, is a program error note released on May 8, 2012. Below are the symptom and SAP recommended solution.

Description

Symptom

The Application Component CRM-MD-PRO-OBJ can be exploited by a malicious user to modify displayed application content without authorization. This vulnerability may allow the attacker to obtain authentication information from other legitimate users.

Solution

To remediate this vulnerability, apply SAP Note 1676849 or import the necessary changes via the relevant support packages.

Reason and prerequisites

The BSP Page COM_BSP_IO_MAP/iobject_location.htm within the Application Component CRM-MD-PRO-OBJ does not sufficiently encode output parameters, leading to a cross-site scripting (XSS) vulnerability.

Exploiting this XSS vulnerability allows an attacker to:

• Steal authentication information, such as session data.
• Impersonate users, potentially gaining access with the same privileges.
• Compromise the security of the application, especially if an administrator is impersonated.

CVSS

Score 0

References

• SAP Note 1669624 – SAP CRM 2005 – SP Stack 20
• SAP Note 1582870 – ABAP XSS Escaping Support
• SAP Note 1582867 – Security options (XSS) for ESCAPE