Unauthorized modification of displayed content in IC_BASE, SAP security note 1684344

SAP security note 1684344, “Unauthorized modification of displayed content in IC_BASE”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

• Unauthorized alteration of application content in IC_BASE.
• Possible theft of user authentication information via reflected XSS.

Solution

• Apply the provided correction instructions to address the issue.
• Alternatively, upgrade to the support package outlined in this note.

Reason and prerequisites

HTML pages within BSP Application IC_BASE do not adequately encode INPUT and OUTPUT parameters, resulting in a reflected XSS vulnerability. Exploiting this can allow attackers to deface web content or steal authentication data, potentially compromising application security fully if administrative accounts are targeted.

Affected components

• SAP_ABA 700
• WEBCUIF 700, 701, 730, 731, 746