SAP security note 1765267, "Unauthorized modification of displayed content in ESREGBASIC". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An attacker can abuse ESREG-BASIC to modify displayed content without authorization and potentially steal authentication information from other users.
Solution
Apply the patch provided in the components specified in the Patch section of this note. The patch archives are available on the SAP Service Marketplace as described in Note 952402.
Reason and prerequisites
Pages within ESREG-BASIC do not sufficiently encode input parameters, resulting in a reflected cross-site scripting (XSS) vulnerability.
Attackers can non-permanently alter or deface displayed content on the affected web pages. Attackers may steal user authentication information, allowing them to impersonate users and access information with the same privileges.
CVSS
Score 4.3 Vector: AV:N/AC:M/AU:S/C:N/I:P/A:N
References
- Note 1911067: Unauthorized modification of displayed content in ESREGBASIC.
Affected components
- ESREG-BASIC versions 7.20, 7.30, 7.31
Full note on SAP: SAP Support Launchpad note 1765267
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
