Security

SAP cleans up more than a dozen troubling CRM security blunders

19 vulnerabilities squished this month – get patching

By John Leyden

5 SHARE

Critical issues in SAP’s CRM application – patched on Tuesday – open the door to corporate espionage, security researchers warn.

SAP resolved a total of 19 software flaws yesterday. Among the most critical bugs is an SQL injection in SAP CRM WebClient User Interface (SAP Security Note 2450979). The issue, identified by researchers at enterprise app security specialists ERPScan, allows a remote attacker to send a special request and steal sensitive customer data including customer datasets, pricing, sales, and prospective bids.

“We recommend that SAP Customers patch vulnerabilities affecting SAP CRM as soon as possible, because this application stores and processes the lifeblood of any business – customer data,” Alexander Polyakov, founder and CTO of ERPScan told El Reg.

ERPScan’s review of SAP’s August patch batch can be found here. The majority of patches released by SAP this month are rated medium. The most common vulnerability type is cross site scripting (XSS).

SAP’s summary is here. In response to queries from El Reg, SAP confirmed ERPScan’s discovery without commenting on its potential seriousness. A spokesperson said:

SAP Product Security Response Team collaborates frequently with research companies like ERPScan to ensure a responsible disclosure of vulnerabilities. All vulnerabilities in question have been fixed, and security patches are available for download on the SAP Support Portal. We strongly advise our customers to secure their SAP landscape by applying the available security patches immediately.

August’s Patch Tuesday also brought updates from Microsoft and Adobe, as previously reported. ®

Sign up to our NewsletterGet IT in your inbox daily

5 Comments

More from The Register

SAP okays Java EE being Eclipsed, six months after Oracle's announcement

But warns it will bail if something better comes along

SAP 404s sap.com blog post that said it's fallen behind on SaaS subs

Partner-penned post said SAP might be as good as Google or IBM ... one day

SAP's Business Client can own entire apps, DDOS them into dust

And that's the worst of ten patches awaiting lucky, lucky SAP admins

Oracle gets busy with Lazy FPU fix, adds more CPU Spectre-protectors

Oracle Linux and VM get their innoculations

Researchers slap SAP CRM with vuln combo for massive damage

Directory traversal + log injection = I can see your privates

Teradata lobs sueball at SAP, alleges HANA based on its 'trade secrets'

Claims German biz used ERP to 'lure' them into joint venture

Oracle Access Manager is a terrible doorman: Get patching this bug

Security tool can be gamed to let any old riffraff into data

Umm, Oracle – about that patch? It might not be very sticky ...

Security researcher says WebLogic fix can be bypassed, posts proof-of-concept

SAP made a mistake on its own blog - mobile platform to survive

UPDATE Cloud-herding plan still in force

Git security vulnerability could lead to an attack of the (repo) clones

Best git patching y'all