Unauthorized modification of stored content in SCM-BAS-UIF, SAP security note 1920522

SAP security note 1920522, "Unauthorized modification of stored content in SCM-BAS-UIF". Below are the symptom and SAP recommended solution.

Description

Symptom

SNC UI Framework can be abused by an attacker, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

Implement the attached source code correction.

Reason and prerequisites

Certain parts of the UI Framework do not sufficiently encode input parameters, resulting in a stored cross-site scripting issue.

Impact:

• Permanently modify displayed content on a website.
• Embed content that is rendered automatically without targeting individual victims.
• Steal another user’s authentication information, such as session data.
• Impersonate users to access information with the same rights.
• Compromise the security of the application if an administrator is impersonated.