SAP security note 1686828, "Unauth. modification of displayed content in Budgeting". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Budgeting can be abused by an attacker, allowing unauthorized modification of displayed application content and the potential theft of authentication information from other legitimate users.
Solution
Implement the attached correction instructions or import the appropriate Support Package.
Reason and prerequisites
Pages within the BSP package PAOC_ECM_BDG_UI_BSP do not sufficiently encode parameters, resulting in a reflected cross-site scripting vulnerability. This flaw can be exploited to temporarily deface or modify website content and steal user authentication information. An attacker could impersonate users, potentially gaining access to sensitive information and compromising application security if an administrator's credentials are stolen.
CVSS
Score 0
Affected components
- PA-EC-BD (Personnel Management > Enterprise Compensation Management > Compensation Budgeting), versions 200, 500, 600, 602, 603, 604, 605, 606
Full note on SAP: SAP Support Launchpad note 1686828
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].