SAP Security Note
High priority
SAP security note 2206793, "Unauthorized modification of displayed content in RWB", is a program error note released on 12.01.2016. Below are the symptom and SAP recommended solution.
Description
Symptom
RWB can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.
Solution
Please update the software components of your system to the patch levels maintained in the "SP Patch Level" section of this note or use newer versions to fix the described security vulnerability.
The archives and the support package stack guide can be found on the SAP Service Marketplace.
Reason and prerequisites
Web pages within 'Process Integration Runtime Workbench' do not sufficiently encode URL parameters, resulting in a reflected cross-site scripting issue. This vulnerability can be exploited to non-permanently deface or modify displayed content and steal authentication information, potentially allowing attackers to impersonate users with the same rights.
CVSS
Score 4.3 / 10 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
Full note on SAP: SAP Support Launchpad note 2206793
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
