Unchecked parameters can lead to unauthorized modification, SAP security note 1624284

SAP security note 1624284, "Unchecked parameters can lead to unauthorized modification", is a program error note released on 10.01.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The ep.runtime.navigation component receives string parameters from the client-side. Malicious users can abuse these parameters to write unauthorized data.

Solution

Apply the patch from the SP Patch Level tab page, as referenced in this note.

Reason and prerequisites

Suspicious functions in ep.runtime.navigation can result in a stored cross-site scripting issue. This vulnerability allows malicious users to permanently modify displayed content on a website, enabling them to embed content that is rendered automatically without targeting victims individually.

CVSS

Score 0

References

• 1668357 – SAP NetWeaver CE Portal Platform NW7.2 SP5 Known Issues
• 1652471 – Central Note for NetWeaver 7.31 SP03 EP / EPC
• 1652470 – Central Note for NetWeaver 7.31 SP02 EP / EPC
• 1652469 – Central Note for NetWeaver 7.31 SP01 EP / EPC
• 1638465 – Central Note for Portal Platform in SAP NW7.2 SP7
• 1630284 – Central Note for NetWeaver 7.30 SP07 EP / EPC
• 1627935 – Known Issues for NetWeaver Portal 7.30 SP04
• 1611646 – Known Issues for NetWeaver Portal 7.30 SP03
• 1611050 – SAP NetWeaver CE Portal Platform NW7.2 SP6 Known Issues
• 1609718 – Central Note for NetWeaver 7.30 SP05 EP / EPC
• 1531306 – Central Note for NetWeaver 7.30 EP / EPC

Affected components

• EP-RUNTIME (7.20, 7.30, 7.31)