SAP cleans up more than a dozen troubling CRM security blunders

19 vulnerabilities squished this month – get patching

Critical issues in SAP’s CRM application – patched on Tuesday – open the door to corporate espionage, security researchers warn.

SAP resolved a total of 19 software flaws yesterday. Among the most critical bugs is an SQL injection in SAP CRM WebClient User Interface (SAP Security Note 2450979). The issue, identified by researchers at enterprise app security specialists ERPScan, allows a remote attacker to send a special request and steal sensitive customer data including customer datasets, pricing, sales, and prospective bids.

“We recommend that SAP Customers patch vulnerabilities affecting SAP CRM as soon as possible, because this application stores and processes the lifeblood of any business – customer data,” Alexander Polyakov, founder and CTO of ERPScan told El?Reg.

ERPScan’s review of SAP’s August patch batch can be found here. The majority of patches released by SAP this month are rated medium. The most common vulnerability type is cross site scripting (XSS).

SAP’s summary is here. In response to queries from El?Reg, SAP confirmed ERPScan’s discovery without commenting on its potential seriousness. A spokesperson said:

SAP Product Security Response Team collaborates frequently with research companies like ERPScan to ensure a responsible disclosure of vulnerabilities. All vulnerabilities in question have been fixed, and security patches are available for download on the SAP Support Portal. We strongly advise our customers to secure their SAP landscape by applying the available security patches immediately.

August’s Patch Tuesday also brought updates from Microsoft and Adobe, as previously reported. ?


Biting the hand that feeds IT ? 1998–2017

<progress id="haujiCA"></progress>
<progress id="haujiCA"></progress>
<address id="haujiCA"><thead id="haujiCA"><ins id="haujiCA"></ins></thead></address>
<address id="haujiCA"><thead id="haujiCA"><ins id="haujiCA"></ins></thead></address><address id="haujiCA"><thead id="haujiCA"></thead></address>
<progress id="haujiCA"></progress>
<address id="haujiCA"></address>
<progress id="haujiCA"></progress>
<address id="haujiCA"></address>
<progress id="haujiCA"><menuitem id="haujiCA"><ins id="haujiCA"></ins></menuitem></progress>
<progress id="haujiCA"></progress>
<progress id="haujiCA"></progress>
<progress id="haujiCA"><var id="haujiCA"><dl id="haujiCA"></dl></var></progress>
<address id="haujiCA"><thead id="haujiCA"></thead></address>
<progress id="haujiCA"><menuitem id="haujiCA"></menuitem></progress><progress id="haujiCA"></progress><th id="haujiCA"></th>
<progress id="haujiCA"></progress>
<listing id="haujiCA"><var id="haujiCA"><ins id="haujiCA"></ins></var></listing>
<address id="haujiCA"></address>
<thead id="haujiCA"></thead>
<th id="haujiCA"><menuitem id="haujiCA"><cite id="haujiCA"></cite></menuitem></th>
<progress id="haujiCA"><ins id="haujiCA"></ins></progress><thead id="haujiCA"><ruby id="haujiCA"></ruby></thead><progress id="haujiCA"><del id="haujiCA"></del></progress>
<progress id="haujiCA"><listing id="haujiCA"></listing></progress>
  • 44834841 2018-01-18
  • 386713840 2018-01-18
  • 170438839 2018-01-18
  • 217748838 2018-01-18
  • 965847837 2018-01-18
  • 788607836 2018-01-18
  • 464515835 2018-01-18
  • 409851834 2018-01-18
  • 816856833 2018-01-18
  • 240698832 2018-01-18
  • 325735831 2018-01-17
  • 162536830 2018-01-17
  • 48476829 2018-01-17
  • 804110828 2018-01-17
  • 74358827 2018-01-17
  • 613608826 2018-01-17
  • 955358825 2018-01-17
  • 318587824 2018-01-17
  • 196263823 2018-01-17
  • 409554822 2018-01-17