SAP Security Note
Medium priority
SAP security note 1819984, "Potential illegal redirection of Web site content in AS Java", is a program error note released on 09.07.2013. Below are the symptom, SAP recommended solution and CVSS score.
Description
Symptom
AS Java can be abused by attackers, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.
Solution
Update your AS Java to a Support Package (SP) or release where the issue is fixed. Refer to the Support Package Patch Level section below for details and available patches.
Reason and prerequisites
The root crossdomain.xml within AS Java does not sufficiently define permission parameters. As a result, a malicious user may perform a cross-domain redirection attack against a legitimate user.
CVSS
Score 5.0 Vector: AV:N/AC:L/AU:N/C:N/I:P/A:N
References
Full note on SAP: SAP Support Launchpad note 1819984
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
