Potential Security Issues in SAP Solution Manager, SAP security note 1418032

SAP security note 1418032, "Potential Security Issues in SAP Solution Manager", is a note released on April 13, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Note addresses critical security vulnerabilities in the Operations part of SAP Solution Manager (Component: SV-SMG-OP). The following risks are mitigated:

• Cross Site Scripting (XSS): Allows unauthorized modification of displayed content and potential theft of authentication information.
• SQL Injection: Enables execution of arbitrary database commands to retrieve, modify, or remove data.
• Hard-coded User Names (Backdoor): Contains code that alters program behavior upon successful authentication with specific usernames, potentially revealing sensitive information.

Solution

Implement this SAP Note via the Note Assistant (transaction SNOTE).

References

• 1418031 – Potential Security Issues in SAP Solution Manager
• 888889 – Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP Solution Manager ST400