Unauthorized usage of appl. functionality in FIN-SEM-CPM, SAP security note 1509929

SAP security note 1509929, "Unauthorized usage of application functionality in FIN-SEM-CPM", is released on 27.07.2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can trigger functionality in FIN-SEM-CPM without authentication and authorization.

Solution

• Apply correction instructions using transaction SNOTE.
• For additional information and instructions, see Note 1520324. The corrections from Note 1520324 are a prerequisite for implementing this note.
• Implement the correction instructions provided in this note. Create the report ZBSP_XSRF_PARAM_FIN_SEM_CPM as a local object in your system.
• Execute the report ZBSP_XSRF_PARAM_FIN_SEM_CPM and, when requested, specify a relevant transport request number. The report will fill the database table BSPTEMPXSRFSTORE.
• Update also Java applets. The applets and how-tos are stored in the corresponding notes 650274, 650264, 650252 and 650241.

Reason and prerequisites

FIN-SEM-CPM executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.

CVSS

Score 0

References

Affected components

• SEM-BW 400
• SEM-BW 600
• SEM-BW 700
• SEM-BW 602
• SEM-BW 603
• SEM-BW 604
• SEM-BW 605
• SEM-BW 634