Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Unauthorized modification of displayed content in CRM IC MDB, SAP security note 1497321

Description

The CRM IC Manager Dashboard and Personalization BSP applications can be abused by a malicious user allowing them to modify displayed application content without authorization and to potentially obtain authentication information from other legitimate users.

Available fix and Supported packages

  • BBPCRM | 500 | 500
  • BBPCRM | 520 | 520
  • BBPCRM | 600 | 600
  • BBPCRM | 700 | 700
  • BBPCRM | 701 | 701
  • BBPCRM 701 | SAPKU70102 |
  • BBPCRM 500 | SAPKU50018 |
  • BBPCRM 520 | SAPKU52011 |
  • BBPCRM 600 | SAPKU60009 |
  • BBPCRM 700 | SAPKU70009 |

Affected component

    CRM-IC-MDB
    Manager Dashboard

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1497321

TAGS

#Reflected-Cross-Site-Scripting
#XSS
#CRM_IC_MDB
#CRM_IC_MDB_PERS

More to explorer

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.