Unauthorized Modification of Displayed Content in HTMLB, SAP security note 1653473

SAP security note 1653473, “Unauthorized Modification of Displayed Content in HTMLB”. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

HTMLB can be exploited by an attacker to modify displayed application content without authorization. This vulnerability allows potential theft of authentication information from other legitimate users.

• Reflected Cross-Site Scripting (XSS): Enables attackers to deface or modify content non-permanently from a web site.
• Credential Theft: Attackers can steal authentication information, such as session data, to impersonate users.
• Full Application Compromise: If an administrator’s credentials are compromised, the security of the entire application may be at risk.

Solution

Apply the relevant Support Package (SP) patch to address the vulnerability. Specific patch numbers are provided in the SAP Note.

References

• 1637338 – Unauthorized modification of displayed content in UR
• 1590008 – JAVA output encoding

Affected components

• Enterprise Portal Development Kit (PDK)
• HTMLB Business for Java
• Various Framework Extensions