Unauthorized modification of displayed content in CacheAPITester and findMerge, SAP security note 2238765

SAP security note 2238765, “Unauthorized modification of displayed content in CacheAPITester and findMerge”, is a note released on 08.03.2016. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

CacheAPITester, CacheTimestampTest, and findMerge can be exploited by an attacker to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.

Solution

Check the “Support Packages & Patches” section within this note to find the appropriate Support Package (SP) and Patch levels that address this issue.

Reason and prerequisites

The functions CacheAPITester, CacheTimestampTest, and findMerge do not sufficiently encode OUTPUT parameters, leading to a reflected cross-site scripting (XSS) vulnerability. This can be exploited to deface or modify web content temporarily and steal users’ authentication information.

CVSS

Score 6.1 / 10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Affected components

• EP RUNTIME 7.10 to 7.11
• EP RUNTIME 7.20
• EP RUNTIME 7.30 to 7.31
• EP RUNTIME 7.40 to 7.50