SAP security note 1676678, “Unauthorized Content Modification in FS-CD”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can exploit the Italian agency collections function in FS-CD to modify displayed application content without authorization. This can result in defacing web pages or stealing authentication information from legitimate users, enabling impersonation and unauthorized access.
Solution
Implement the provided corrections by applying the relevant Support Package available for your software component version.
References
- Related SAP Note 1644876: Unauthorized modification of displayed content in agency collections.
Affected components
- INSURANCE 600, 602, 603, 604, 605, 606, 616
Full note on SAP: SAP Support Launchpad note 1676678
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
