High priority
SAP security note 1678643, "Unauthorized Modification in BSP Application in FIN-SEM-CPM", is a note released on May 8, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
FIN-SEM-CPM can be exploited by a malicious user, allowing unauthorized modification of displayed application content and potential theft of authentication information from other legitimate users.
Solution
Apply this SAP Note or import the changes via the relevant support package. The correction includes switching the HTMLB design for the following application to DESIGN2008:
- SC_WIZARD
Reason and prerequisites
BSP Page(s) (SC_WIZARD) within FIN-SEM-CPM do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting vulnerability. This can enable attackers to steal another user's authentication information, potentially allowing them to impersonate the user and access sensitive information. If an administrator is impersonated, the entire application's security could be compromised.
Affected components
- Financials > Strategic Enterprise Management > Corporate Performance Monitor > Balanced Scorecard (FIN-SEM-CPM-BSC)
Full note on SAP: SAP Support Launchpad note 1678643
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
