Unauthorized use of application functions in BC-CCM-MON, SAP security note 1662714

SAP security note 1662714, “Unauthorized use of application functions in BC-CCM-MON”, is a program error note released on 14.02.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in BC-CCM-MON without authentication and authorization.

Solution

Please migrate to the corresponding support package. The relevant BSPs will be deleted as they are no longer used.

If you cannot update your system to the mentioned support package, you need to manually delete the affected BSP applications (this functionality isn’t supported anymore and can be deleted) as follows:

• Open transaction SE80.
• Select type: “BSP Application”.
• Enter BSP_CCMS_AL_MINIAPP_ALVIEWER.
• Right-click on this object and select “Delete”.
• Confirm Deletion.
• Add this deletion to a transport request.
• Repeat these steps for BSP applications BSP_CCMS_AL_MINIAPP_ICONVIEW and BSP_CCMS_AL_PAGE_BUILDER.

Reason and prerequisites

BC-CCM-MON executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the rights of the authenticated user. This can be achieved through a cross-site scripting attack or by presenting a deceptive link to the victim.

Affected components

• SAP_BASIS: 620 to 640
• SAP_BASIS: 700 to 702
• SAP_BASIS: 710 to 730