SAP Note 1488008
SAP security note 1488008, "Unauthorized modification of displayed content in Attachment". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Malicious users can modify displayed application content without authorization, potentially obtaining authentication information from other legitimate users.
- Allows embedding of malicious content that is automatically rendered.
- Theft of user authentication information, enabling impersonation of users.
- If an administrator’s credentials are compromised, the application’s security can be fully compromised.
Solution
To address this vulnerability, you should either:
- Import the Corresponding Support Package: apply the relevant support package for your SRM version.
- Implement the Attached Correction Instruction.
Affected components
- SAP SRM 7.01
- SAP SRM 7.0
- SAP SRM 6.0
- SAP SRM 5.0
Full note on SAP: SAP Support Launchpad note 1488008
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
