SAP security note 1497321, “Unauthorized modification of displayed content in CRM IC MDB”, is a note released on December 14, 2010. Below is the security information published by SAP for this note.
Description
Overview
SAP has released Security Note 1497321 addressing a critical vulnerability in the CRM Interaction Center Manager Dashboard (CRM IC MDB). This security issue allows malicious users to modify displayed application content without authorization and potentially steal authentication information from other legitimate users.
Vulnerability description
A reflected Cross-Site Scripting (XSS) vulnerability exists in certain pages within the CRM_IC_MDB and CRM_IC_MDB_PERS BSP applications. Insufficient encoding of parameters enables attackers to:
- Deface or modify displayed content non-permanently.
- Steal authentication information, potentially allowing impersonation of legitimate users.
- In the case of administrative accounts, this could lead to a full compromise of the application's security.
Solution
To mitigate this vulnerability, apply the relevant service package or implement the provided correction instructions manually. Details for support packages and correction instructions are available below:
- Support Packages:
- Correction Instructions:
Additional information
- Symptoms: Unauthorized modification of displayed content and potential theft of authentication data.
- Affected Applications: CRM IC Manager Dashboard and Personalization BSP applications.
- Other Terms: Reflected Cross Site Scripting (XSS), CRM_IC_MDB, CRM_IC_MDB_PERS
References
Full note on SAP: SAP Support Launchpad note 1497321
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].