SAP security note 2166779, "Unauthorized modification of displayed content in Performance Management Application". Below are the symptom and SAP recommended solution.
Description
Symptom
The Performance Management Application can be exploited by an attacker to modify displayed application content without authorization. This vulnerability may also allow attackers to obtain authentication information from other legitimate users, potentially leading to unauthorized access and impersonation.
Solution
The issue has been addressed and fixed in the following Support Package Patches.
CVSS
Score 4.3 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
References
Full note on SAP: SAP Support Launchpad note 2166779
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].