SAP security note 1514927, "Unauthorized modification of displayed content in BW", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user could exploit this vulnerability to modify displayed application content without proper authorization and potentially steal authentication information from other legitimate users.
Solution
- Implement Security Note 875986 before applying Security Note 1514927; this prerequisite is crucial for addressing related security aspects.
- Apply Security Note 1514927, following the instructions provided in this note to secure your SAP BW environment against the described XSS vulnerability.
Reason and prerequisites
The issue arises from insufficient encoding of input parameters in a potential HTTP-API interface within BW. If a customer implements this web handler in an SICF service, it results in a reflected cross-site scripting vulnerability.
Successful exploitation could allow attackers to deface or alter website content and steal user session data. In cases where an administrator’s credentials are compromised, this could lead to a full security breach of the application.
References
This note refers to
Affected components
- SAP_BW versions 30B to 730
- SAP_BW_VIRTUAL_COMP versions 30B and 701
Full note on SAP: SAP Support Launchpad note 1514927
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].