Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Missing input validation in SLD UI pages, SAP security note 1451843

SAP Note 1451843
SAP Security Note
High priority

SAP security note 1451843, "Missing input validation in SLD UI pages", is a program error note released on 28.01.2013. Below are the symptom and SAP recommended solution.

ComponentBasis Components > Computer Center Management System (CCMS) > System Landscape Directory / Component Repository (BC-CCM-SLD)
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
StatusReleased for Customer
Released on28.01.2013

Description

Symptom

When you use HTTP to call Web pages, parts of the parameters for dynamic construction of these pages may be transferred. In certain situations, this can be used for cross-site scripting attacks.

Solution

Apply the relevant patches.

Reason and prerequisites

There is a danger of cross-site scripting on certain profile user interface (UI) pages.

References

Full note on SAP: SAP Support Launchpad note 1451843

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SLD #System Landscape Directory #Cross-site scripting (XSS)

Explore More