Medium priority
SAP security note 1784770, "Unauthorized modification of displayed content in CR Server", is a program error note released on 08.01.2013. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Security Note 1784770 addresses a security vulnerability in the XIr3 Infoview web application that allows unauthorized modification of displayed content and potential theft of authentication information.
The XIr3 Infoview web application can be abused by an attacker, enabling them to modify displayed application content without authorization. This vulnerability may also allow attackers to obtain authentication information from other legitimate users.
Solution
Customers should install FixPack 4.3 or FixPack 5.3 to address this issue.
Reason and prerequisites
Pages within XIr3 do not sufficiently encode input parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. This can be exploited to non-permanently deface or modify displayed content on a website or steal another user's authentication information, potentially allowing an attacker to impersonate the user and access information with the same permissions.
CVSS
Score 3.5 Vector: AV:N/AC:M/AU:S/C:N/I:P/A:N
Affected components
- BOEWEBAPPJAVA, version 3.1
Full note on SAP: SAP Support Launchpad note 1784770
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].