SAP Security Note
Medium priority
SAP security note 1787906, "Unauthorized modification of displayed content in BSP pages", is a note released on January 24, 2014. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
BSP Extensions in the BC-BSP package can be abused by an attacker, allowing unauthorized modification of displayed application content. This vulnerability may enable attackers to obtain authentication information from legitimate users.
Solution
Apply the correction instructions provided in this SAP Note using the Note Assistance tool.
Reason and prerequisites
BSP extensions within BC-BSP do not sufficiently encode output parameters, resulting in a reflected cross-site scripting vulnerability. This can allow attackers to deface or modify web content temporarily and steal user authentication information. If an attacker impersonates an administrator, the security of the entire application may be compromised.
CVSS
Score 0
Affected components
- SAP_BASIS: 620 to 640, 700 to 702, 710 to 730, 731, and 740
Full note on SAP: SAP Support Launchpad note 1787906
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
