Unauth. modification of displayed content in ICF Recorder, SAP security note 1590341

SAP security note 1590341, "Unauthorized Modification of Displayed Content in ICF Recorder", is a program error note released on 08.05.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The ICF Recorder does not sufficiently encode output parameters, resulting in a reflected cross-site scripting (XSS) issue. This vulnerability can be exploited to:

• Deface or modify displayed content on a website.
• Steal authentication information, such as session data.
• Impersonate users, including administrators, thereby compromising application security.

Solution

Implement the specified source code changes by following the relevant correction instructions provided in the note. Ensure that you apply the necessary support packages for your SAP_BASIS versions.

References

• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730
• SAP_BASIS 731