Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing input validation in SLD UI pages, SAP security note 1416047

SAP Note 1416047
SAP Security Note
High priority

SAP security note 1416047, "Missing input validation in SLD UI pages", is a program error note released on February 10, 2010. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Computer Center Management System (CCMS) > System Landscape Directory / Component Repository (BC-CCM-SLD)
CategoryProgram error
PriorityHigh priority
TypeSAP Security Note
StatusReleased for Customer
Released onFebruary 10, 2010

Description

Symptom

When you use HTTP to call web pages, parts of the parameters for dynamic construction of these pages may be transferred. In certain situations, this can be used for cross-site scripting attacks.

Solution

Apply the relevant patches.

Reason and prerequisites

There is a danger of cross-site scripting on certain SLD user interface (UI) pages.

Full note on SAP: SAP Support Launchpad note 1416047

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#System Landscape Directory #Cross-Site Scripting #BC-CCM-SLD

Explore More