Unauthorized changes can be made to Web Dynpro ABAP session, SAP security note 1436936

SAP security note 1436936, "Unauthorized changes can be made to Web Dynpro ABAP session". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A critical security vulnerability has been identified in Web Dynpro ABAP that allows malicious users to perform unauthorized data modifications. This can be achieved by exploiting Cross-Site Request Forgery (XSRF/CSRF) vulnerabilities, enabling attackers to hijack the logon credentials of legitimate users. This note has been updated; refer to SAP Note 1528863 for comprehensive details.

This leads to unauthorized data changes, as attackers can manipulate backend data without proper authorization, and to user credential compromise, as attackers can bypass security measures by imitating legitimate user logon data.

Solution

• Ensure that your SAP_BASIS component is updated to one of the following support packages: SAPKB70022, SAPKB70107, SAPKB70204, SAPKB71010, SAPKB71105, or SAPKB72003.
• Implement the correction instructions provided in the security note.

References

• 888889 – Automatic checks for security notes using RSECNOTE
• 1410548 – Generating random values via PRNG
• 1529208 – New ICF handler for JNet in cProjects

Affected components

• SAP_BASIS (700, 701, 702, 710, 711, 720)
• Web Dynpro ABAP Runtime (BC-WD-ABA-RUN)