Unauthorized modification of displayed content in Attachment, SAP security note 1488008

SAP security note 1488008, "Unauthorized modification of displayed content in Attachment". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Malicious users can modify displayed application content without authorization, potentially obtaining authentication information from other legitimate users.

• Allows embedding of malicious content that is automatically rendered.
• Theft of user authentication information, enabling impersonation of users.
• If an administrator’s credentials are compromised, the application’s security can be fully compromised.

Solution

To address this vulnerability, you should either:

• Import the Corresponding Support Package: apply the relevant support package for your SRM version.
• Implement the Attached Correction Instruction.

Affected components

• SAP SRM 7.01
• SAP SRM 7.0
• SAP SRM 6.0
• SAP SRM 5.0