Unauthorized modif. of stored content in Compl. Workbench, SAP security note 1476347

SAP security note 1476347, "Unauthorized modification of stored content in Complaint Workbench", is a program error note released on December 14, 2010. Below are the symptom and the SAP recommended solution.

Description

Symptom

The BSP (Business Server Pages) based complaint workbench for agency business could be abused by a malicious user, who could modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

This issue affects only the old BSP based workbench. The new Web Dynpro based workbench does not have this problem.

Solution

Please apply the correction as outlined in this SAP Security Note.

Prerequisite: For release EA-RETAIL 200, SAP Note 1475840 is required.

Reason and prerequisites

Stored cross-site scripting can be used to permanently modify displayed content from a website, allowing the malicious user to embed content that is rendered automatically, without the need to individually target victims.

Additionally, stored cross-site scripting can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data could impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the application’s security could be fully compromised.

CVSS

Score 0

References