Skip links

Security fixes for SRM SUS, Vendor Evaluation, SRM ROS, SAP security note 1411659

Description

Due to a vulnerability which exists in the SRM Supplier Self-Services (SRM SUS) application, Vendor Evaluation (SRM VE) application and Registration of Supplier (SRM ROS) application which are part of the SAP Supplier Relationship management (SAP SRM) solution, it is possible for a hacker to inject malicious code into the above mentioned applications at runtime which can allow them to steal the current logged on user’s data and perform unauthorized actions without the knowledge of the logged in user.

Vulnerability Details:

  • The hacker can enter a executable HTML or JAVAScript command into the input fields and save it to the database. Once page which display this data is visited by a user for a legitimate business purpose, the JAVAScript command contained in the database will be executed thereby allowing the hacker to receive the data in the current context or modify the data in the current context or execute critical actions without the knowledge of the legitimate logged in user.


Affected Releases:

  • SAP SRM 4.0
  • SAP SRM 5.0
  • SAP SRM 6.0
  • SAP SRM 7.0

Available fix and Supported packages

  • SRM_SERVER | 500 | 500
  • SRM_SERVER | 550 | 550
  • SRM_SERVER | 600 | 600
  • SRM_SERVER | 700 | 700
  • SRM_SERVER 600 | SAPKIBKU06 |
  • SRM_SERVER 500 | SAPKIBKS16 |
  • SRM_SERVER 550 | SAPKIBKT16 |
  • SRM_SERVER 700 | SAPKIBKV06 |
  • SRM_SERVER 500 | SAPKIBKS17 |
  • SRM_SERVER 550 | SAPKIBKT19 |

Affected component

    SRM-SUS
    Supplier Self-Services

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1411659

TAGS

#SRM
#Supplier-Relationship-Management
#procurement
#E-Commerce
#Web
#business-to-business
#SAP-Business-to-Business-Procurement-BBP
#business-to-business
#e-business
#Ebusiness
#Internet
#EBP
#Enterprise-Buyer
#EnterpriseBuyer-professional-edition
#SRM_SERVER
#SRM-SUS
#Supplier-Self-Service
#Vendor-Evaluation
#Registration-of-Suppliers
#ROS
#VE
#SUS
#Cross-Site-Script
#Cross-Site-Scripting-attack
#XSS
#Security