SAP security note 1470998, "Unauthorized Modification of Displayed Content in WEBCUIF", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP has released Security Note 1470998 addressing a critical vulnerability in the WEBCUIF and CRMUIF components. This issue allows malicious users to perform unauthorized modifications of displayed application content, potentially leading to the theft of authentication information and session hijacking.
- Unauthorized modification of web page content
- Theft of user authentication data
- Potential for full application compromise if an administrator's session is hijacked
- Malicious scripts can modify displayed content without authorization
- Potential for defacing web interfaces and stealing session information
Solution
To mitigate this vulnerability, implement the corrections provided in Security Note 1470998. Ensure that all applicable software components are updated to the recommended support packages.
Affected components
- CRMUIF: 510, 520, 600
- WEBCUIF: 700, 701, 730
Full note on SAP: SAP Support Launchpad note 1470998
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].