SAP security note 2204581, “Unauthorized Modification in BI Workspace via XSS”. Below are the symptom and the affected software components.
Description
Symptom
SAP Security Note 2204581 addresses a vulnerability in the BI Workspace that allows an attacker to modify displayed application content without authorization. This issue can potentially enable attackers to obtain authentication information from other legitimate users, leading to unauthorized access and potential impersonation of users, including administrators.
CVSS
Score 6.1 / 10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- 2144559: BI 4.x Maintenance Strategy & Schedule
Affected components
- ENTERPRISE (XI 3.0, 4.0, 4.10, 4.20)
Full note on SAP: SAP Support Launchpad note 2204581
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].