SAP Security Note
High priority
SAP security note 1838814, “Unauthorized modification of stored content in cFolders”, is a program error note released on June 11, 2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can abuse cFolders to modify application content, persist unauthorized changes, and potentially obtain authentication information from other legitimate users.
Solution
Implement the recommended coding changes provided in the SAP Security Note to mitigate the vulnerability.
Reason and prerequisites
The vulnerability allows for cross-site scripting, enabling permanent modification of displayed website content. This permits attackers to embed content that is rendered automatically without needing to target victims individually.
CVSS
Score 0
Affected components
- CPRXRPM 400
- CPRXRPM 450_700
- CPRXRPM 500_702
Full note on SAP: SAP Support Launchpad note 1838814
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].