Clickjacking vulnerability in Adapter Runtime of SAP Process Integration, SAP security note 2818963

SAP Note 2818963
SAP Security Note

SAP security note 2818963, "Clickjacking vulnerability in Adapter Runtime of SAP Process Integration", is a note. Below are the symptom and SAP recommended solution.

TypeSAP Security Note

Description

Symptom

The Adapter Runtime of SAP Process Integration does not correctly restrict frame objects or UI layers from other applications or domains, resulting in a Clickjacking vulnerability. Successful exploitation of this vulnerability can lead to unwanted modification of user data.

Solution

The vulnerability has been addressed in the Support Packages and Patches referenced in this SAP Security Note. To fully mitigate the attack, you must enable the clickjacking protection framework by performing the following manual activities in each system where the Note is implemented:

Execute Manual Activities:

CVSS

Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References

Full note on SAP: SAP Support Launchpad note 2818963

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Clickjacking #Adapter Runtime #SAP Process Integration #XI Adapter Framework