Unauthorized modification of displayed content in BC-WD-ABA, SAP security note 1929564

SAP security note 1929564, "Unauthorized modification of displayed content in BC-WD-ABA", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

BC-WD-ABA can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

Please apply the correction instructions specified in this security note.

Reason and prerequisites

Pages within BC-WD-ABA do not sufficiently encode output parameters, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a website. It can also be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.

CVSS

Score 4.3 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N

References

• 1950543 – Corrections for unified rendering 701/15 III (UR mimes)
• 1943177 – Corrections for unified rendering 702/15 VII (UR-mimes)
• 1981254 – WD ABAP: Display problems with dialog box title
• 1955280 – Corrections to unified rendering up to 711/14 I (UR MIMEs)
• 1948011 – Corrections for unified rendering 730/12 I (UR-Mimes)
• 1903331 – Corrections for unified rendering up to SAP_BASIS 731/09 II
• 1908692 – Corrections to unified rendering up to SAP_UI 740/04 I