SAP Note 1761018SAP Security Note
SAP security note 1761018, "Unauthorized modification of stored content in BC-COM-WIK", is a note released on January 8, 2013. Below are the symptom and SAP recommended solution.
Description
Symptom
An attacker can exploit BC-COM-WIK to:
- Modify application content without authorization.
- Persist modified content, leading to potential unauthorized data manipulation.
- Steal authentication information from legitimate users, enabling impersonation and unauthorized access.
Solution
- Patch Information: Refer to the "SP Patch Level" tab in SAP Note 1761018 for detailed patch information. For SP Stack schedules and updates, visit SAP Support Package Stacks.
- Workaround: Currently, no workaround is available before applying the specified updates.
Reason and prerequisites
Unauthorized content changes can compromise the integrity of the application. Stolen authentication data can lead to full compromise of user accounts, including administrative privileges if admin accounts are targeted.
CVSS
Score 4.3
References
Referenced by
- SAP Note 1925121 regarding KMC release SAP NetWeaver 7.30 SP9 Add-ons.
Full note on SAP: SAP Support Launchpad note 1761018
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
