SAP Note 1490232
SAP security note 1490232, "Unauthorized modification of displ.content in WFF_ERROR". Below are the symptom and SAP recommended solution.
Description
Symptom
Pages within the WFF_ERROR component do not sufficiently encode output parameters, resulting in a reflected XSS vulnerability. An attacker can:
- Modify Content: Non-permanently deface or alter content displayed on a website.
- Steal Authentication Information: Capture user session data to impersonate users, leading to potential full compromise, especially if an administrator’s credentials are stolen.
Solution
Apply the SAP Security Note using the Note Assistant.
References
This note refers to
Full note on SAP: SAP Support Launchpad note 1490232
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
