Unauthorized modification of stored content in WPC, SAP security note 1519292

SAP security note 1519292, "Unauthorized modification of stored content in WPC". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Web Page Composer can be abused by a malicious user allowing them to modify application content, and persist the modified content without authorization and to potentially obtain authentication information from other legitimate users.

Solution

The solution is available in the following releases:

• Patch 3 for KMC WEB PAGE COMPOSER 7.00 SP 16
• Patch 2 for KMC WEB PAGE COMPOSER 7.00 SP 17
• Patch 3 for KMC WEB PAGE COMPOSER 7.00 SP 18
• Patch 3 for KMC WEB PAGE COMPOSER 7.00 SP 19
• Patch 1 for KMC WEB PAGE COMPOSER 7.00 SP 20
• KMC WEB PAGE COMPOSER 7.00 SP 21
• Patch 2 for KMC WEB PAGE COMPOSER 7.01 SP03
• Patch 1 for KMC WEB PAGE COMPOSER 7.01 SP04
• Patch 1 for KMC WEB PAGE COMPOSER 7.01 SP05
• KMC WEB PAGE COMPOSER 7.01 SP06
• KMC WEB PAGE COMPOSER 7.02 SP02

Reason and prerequisites

Program error resulting in a stored cross site scripting issue. It can be used to permanently modify displayed content from a web site, allowing the malicious user to embed content that is rendered automatically, without the need to individually target victims. Stored cross site scripting can also be used to steal another user’s authentication information such as data relating to their current session. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application’s security may occur.

Affected components

• KMC-WPC: 7.00 to 7.02