SAP Security Note
Medium priority
SAP security note 1865646, "Unauthorized modification of displayed content in FIN-SEM-CP", is a program error note released on January 21, 2016. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can exploit FIN-SEM-BSC to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Solution
Apply the correction instructions using transaction SNOTE.
Reason and prerequisites
Insufficient encoding of output parameters in FIN-SEM-BSC leads to reflected cross-site scripting vulnerabilities.
Affected components
- Financials > Strategic Enterprise Management > Corporate Performance Monitor > Balanced Scorecard
- SEM-BW: 602, 603, 604, 605, 634, 700, 736, 746, 747
Full note on SAP: SAP Support Launchpad note 1865646
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].