SAP Security Note
High priority
SAP security note 1615784, “Unauthorized modification of displayed content in ITS”, is released on 25.10.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The ITS can be abused by a malicious user allowing them to modify displayed application content without authorization and to potentially obtain authentication information from other legitimate users.
Solution
Apply the relevant support package to address the vulnerability.
Reason and prerequisites
Pages within the ITS do not sufficiently encode input parameters, resulting in a reflected cross site scripting issue. A reflected XSS attack can be used to non-permanently deface or modify displayed content from a website. Additionally, it can be used to steal another user’s authentication information, potentially allowing an attacker to impersonate the user and access information with the same rights.
CVSS
Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N
Affected components
- BC-FES-ITS – Basis Components > Frontend Services (SAP Note 1322184) > SAP Internet Transaction Server
Full note on SAP: SAP Support Launchpad note 1615784
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
