SAP Security Note
High priority
SAP security note 1599185, "Unauthorized use of application functions in CLP", is a note released on 09.08.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can execute functions in Collaborative Planning (CLP) without proper authentication and authorization. This vulnerability is related to Cross-Site Request Forgery (XSRF), where an attacker can trick an authenticated user’s browser into making unauthorized requests that execute functions with the user’s permissions.
Solution
To address this security issue, implement the attached Correction Instructions or apply the relevant Support Package for your system version.
Affected components
- SCM-APO-CA-COP: 410, 500, 510, 700, 701
Full note on SAP: SAP Support Launchpad note 1599185
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].