Unauthorized modification of displayed content in FIN-BA, SAP security note 1665930

SAP security note 1665930, "Unauthorized modification of displayed content in FIN-BA", released on May 21, 2013. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

FIN-BA can be exploited by an attacker to modify displayed application content without authorization. This vulnerability may allow the attacker to obtain authentication information from other legitimate users.

Solution

Implement the attached correction or apply the corresponding support package relevant to your system’s version. You can download the correction for SNOTE here or view the PDF version here.

Reason and prerequisites

The UAB_COST_ENGINE BSP application does not sufficiently encode input parameters, leading to a reflected cross-site scripting (XSS) vulnerability. An attacker can exploit this to deface or modify website content temporarily or steal user authentication information, potentially compromising the entire application’s security if administrative credentials are obtained.

References

• Update 1 to Security Note 1665930

Affected components

• SEM-BW: 400, 600, 602, 603, 604, 605, 634, 700, 736, 747