Unauthorized modification of stored content in Forums Email, SAP security note 1581257

SAP security note 1581257, “Unauthorized modification of stored content in Forums Email”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Forums application can be abused by a malicious user, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

There are no workarounds for this issue. To resolve it, download and deploy the SCA from the “SP Patch Level” tab page of this SAP note.

Reason and prerequisites

The Forums application (component BC-COM-FOR) has a stored cross-site scripting (XSS) vulnerability. This allows a malicious user to permanently modify displayed content on a website, enabling the embedding of content that is rendered automatically without needing to target victims individually. Additionally, stored XSS can be used to steal another user’s authentication information, such as data related to their current session. A malicious user who gains access to this data may impersonate the user and access all information with the same rights as the target user.

CVSS

Score 0

References

Affected components

• FORUMS (7.00 to 7.02)
• FORUMS (7.30)