Unauthorized modification in displayed content Job Pricing, SAP security note 1452492

SAP security note 1452492, "Unauthorized modification in displayed content Job Pricing", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The BSP Applications for Job Pricing and Budgeting, HRECM_BDG_START and HRECM_JPR_START, have defined target BSP Applications which are passed by a page attribute in a URL. BSP Applications other than the defined ones could be started by users with authorizations by manipulating the page attributes value.

Solution

Implement the corresponding Support Package. The correction will restrict access to the defined BSP applications only.

Reason and prerequisites

Reason: Program error

Prerequisite: You are using the BSP Applications mentioned above.

The BSP pages do not sufficiently encode an input parameter, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a website. Reflected XSS can steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data could impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the application’s security could be fully compromised.

Affected components

• Personnel Management > Enterprise Compensation Management (PA-EC)