Unauthorized modification of displayed content in ICM, SAP security note 1671106

SAP Note 1671106
SAP Security Note
High priority

SAP security note 1671106, “Unauthorized modification of displayed content in ICM”, is a program error note released on May 8, 2012. Below are the symptom and SAP recommended solution.

ComponentCustomer Relationship Management > Public Sector > Investigative Case Management > Cases and Leads

CategoryProgram error

PriorityCorrection with high priority

TypeSAP Security Note

Version3

StatusReleased for Customer

Released onMay 8, 2012

LanguageEnglish

Description

Symptom

CRM-IPS-ICM-CMG can be abused by a malicious user allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.

Solution

Please apply the mentioned support package or implement the correction in the note.

Reason and prerequisites

Pages within the BSP do not sufficiently encode OUTPUT parameters, resulting in a cross site scripting issue. A cross site scripting attack can be used to non-permanently modify displayed content from a web site.

References

Full note on SAP: SAP Support Launchpad note 1671106

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Cross Site Scripting #XSS #CRM-IPS-ICM