SAP Note 1597549
SAP security note 1597549, "Unauthorized modification of displayed content in FSCM_BD". Below are the SAP recommended solution and the affected software components.
Description
Solution
- Apply Support Packages: FSCM_BD 3.0 SP20, FSCM_BD 6.0 SP20, FSCM_BD 6.02 SP10, FSCM_BD 6.04 SP10, FSCM_BD 6.05 SP05.
- Manual Adjustments: If you retain custom JSP content, apply manual changes to ensure output parameters are properly encoded using Biller Direct APIs.
References
Affected components
- FIN-FSCM-BD 3.0 SP20
- FIN-FSCM-BD 6.0 SP20
- FIN-FSCM-BD 6.02 SP10
- FIN-FSCM-BD 6.04 SP10
- FIN-FSCM-BD 6.05 SP05
Full note on SAP: SAP Support Launchpad note 1597549
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].