SAP security note 1700735, "Unauthorized modification of displayed content in SAP ME". Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Manufacturing Execution can be abused by an attacker, allowing them to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Solution
The issue has been addressed in SAP Manufacturing Execution 6.0 SP03. The vulnerabilities were not present in any releases prior to 6.0 SP03.
Reason and prerequisites
Certain pages within SAP Manufacturing Execution do not sufficiently encode INPUT | OUTPUT parameters, resulting in a reflected cross-site scripting vulnerability. An attacker can exploit this to non-permanently deface or modify displayed content from a website. Additionally, this vulnerability can be used to steal another user’s authentication information, such as session data. If an administrator is impersonated, the entire application’s security may be compromised.
Full note on SAP: SAP Support Launchpad note 1700735
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].