SAP security note 1993349, "Unauthorized modification of displayed content in SAP HANA XS Administration Tool", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The SAP HANA XS Administration Tool can be exploited by an attacker to modify displayed application content without authorization. This vulnerability may also allow the attacker to obtain authentication information from other legitimate users.
Solution
This issue is resolved in:
- SAP HANA Revision 72 (for SPS07)
- SAP HANA Revision 69 Patch Level 04 (for SPS06)
It is recommended to update to these or later revisions to mitigate the vulnerability.
Reason and prerequisites
Functions within the SAP HANA XS Administration Tool do not sufficiently encode or filter output parameters, resulting in a reflected cross-site scripting vulnerability. An attacker can exploit this to non-permanently deface or modify displayed content on a website. Additionally, the attacker may steal user authentication information, potentially allowing impersonation of users and compromising application security.
CVSS
Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N
Full note on SAP: SAP Support Launchpad note 1993349
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
