SAP Security Note
High priority
SAP security note 1670153, “Unauthorized modification in ITS-Services in SWP”, is a note released on 08.05.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Supplier Workplace (IS-A-SWP) can be abused by a malicious user, allowing unauthorized modification of displayed application content and the potential theft of authentication information from legitimate users.
Solution
Apply this SAP Note or import the changes via the relevant support package.
The corrections in this note are only effective if the corrections from notes 1621946 and 1488500 are also implemented.
Reason and prerequisites
ITS Services within IS-A-SWP (including ME_SWP, ME_SWP_ALERT, ME_SWP_CO, ME_SWP_GUI, ME_SWP_IV, ME_SWP_PDI, ME_SWP_PH, ME_SWP_SRI) do not sufficiently encode output parameters, resulting in a cross-site scripting vulnerability. This can be exploited to steal authentication data, enabling the impersonation of users, including administrators, potentially compromising the security of the application.
Affected components
- SAP_APPL 500 to 606
Full note on SAP: SAP Support Launchpad note 1670153
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
