WebReportingUnauthorized modification of displayed content, SAP security note 1536640

SAP security note 1536640, "WebReporting: Unauthorized modification of displayed content", is a note released on May 10, 2011. Below are the symptom and SAP recommended solution.

Description

Symptom

WebReporting can be abused by a malicious user, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

Please apply the following patch: Download for SNOTE.

Reason and prerequisites

A reflected cross-site scripting (XSS) issue in WebReporting allows a malicious user to non-permanently deface or modify displayed content from a website. Additionally, this vulnerability can be exploited to steal another user’s authentication information, potentially enabling an attacker to impersonate the user and access information with the same rights, thereby compromising the security of the application.

CVSS

Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N

References

• SAP Note 1328700 – WebReporting: Exception in module WWW_GET_SCRIPT_AND_HTML