SAP Security Note
High priority
SAP security note 1594977, “Unauthorized use of application functions in CRM-MD-BP-CCP”, is released on November 8, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
A malicious user can execute functions in CRM-MD-BP-CCP without authentication and authorization.
Solution
Implement the attached correction instructions.
Reason and prerequisites
CRM-MD-BP-CCP executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a specific URL and parameters, the function is executed with the rights of the authenticated user. This can be achieved via cross-site scripting (XSS) attacks or by presenting a malicious link to the victim.
CVSS
Score 0
Full note on SAP: SAP Support Launchpad note 1594977
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
