SAP security note 1502781, "Unauthorized modification of displayed content in BSP". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A reflected cross-site scripting (XSS) vulnerability exists due to insufficient encoding of parameters within the ICM. This allows a malicious user to modify displayed content, potentially stealing authentication information and impersonating users, which can lead to full security compromise if an administrator is impersonated.
Solution
Apply the relevant kernel patch indicated in this SAP Note for your release version to correct the security issue.
CVSS
Score 0
References
- SAP Note 1496148 – Unauthorized modification of displayed content in IS-Media
- SAP Note 888889 – Automatic checks for security notes using RSECNOTE (outdated)
Affected components
- Applicable to various SAP Kernel versions from 6.40 to 7.01, both 32-bit and 64-bit, including Unicode variants. For detailed support packages and patches, refer to the Support Package Patches.
Full note on SAP: SAP Support Launchpad note 1502781
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
