SAP Security Note
High priority
SAP security note 1680716, "Unauthorized modification of displayed content in MDSD Admin", is a program error note released on 08.05.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The MDSD Admin Console can be exploited by an attacker to modify displayed application content without authorization. This vulnerability also allows potential access to authentication information from other legitimate users.
Solution
Deploy the updated version of the MDSD Admin Console provided with SAP Note 1582779.
Reason and prerequisites
The MDSD Admin Console within MDSD lacks sufficient encoding of parameters, leading to a reflected cross-site scripting (XSS) vulnerability. This flaw can be exploited to deface or modify website content temporarily and steal users’ authentication data. An attacker can impersonate users, including administrators, potentially compromising the entire application’s security.
References
This note refers to
Affected components
- MBA-DSD 2.1
- MBA-DSD 3.0
Full note on SAP: SAP Support Launchpad note 1680716
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].