High priority
SAP security note 1932505, “Unauthorized modification of displayed content in NWBC”, is a program error note released on January 14, 2014. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can abuse NWBC (NetWeaver Business Client) to modify displayed application content without authorization. This vulnerability may allow the extraction of authentication information from legitimate users, potentially leading to unauthorized access.
Solution
To mitigate this vulnerability, implement SAP Security Note 1932505. Applying this note will address the reflected XSS issue by ensuring proper encoding of input parameters in NWBC.
Reason and prerequisites
The vulnerability arises because test page web services within NWBC do not sufficiently encode input parameters. This lack of proper encoding results in a reflected cross-site scripting (XSS) issue. An attacker exploiting this vulnerability can non-permanently deface or modify web content and potentially steal users’ authentication information, leading to impersonation and unauthorized access.
CVSS
Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N
Affected components
- SAP_UI 740
- SAP_BASIS 700 to 740
Full note on SAP: SAP Support Launchpad note 1932505
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].