Unauthorized use of application functions in FIN-SEM-CPM, SAP security note 1516122

SAP security note 1516122, "Unauthorized use of application functions in FIN-SEM-CPM". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can execute functions in FIN-SEM-CPM without authentication and authorization.

Solution

For additional information and instructions, see Note 1520324. The corrections from Note 1520324 are a prerequisite for implementing this note.

Reason and prerequisites

FIN-SEM-CPM executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to achieve this or present a link to the victim.

CVSS

Score 0

Affected components

• SEM-BW: 400, 600, 602, 603, 604, 605, 634, 700