Unauthorized modification of displayed content in ITS, SAP security note 1693480

SAP security note 1693480, "Unauthorized Modification of Displayed Content in ITS", is a note. Below are the symptom and SAP recommended solution.

Description

Symptom

The Internet Transaction Server (ITS) can be exploited by malicious users to modify displayed application content without authorization. This vulnerability allows attackers to potentially obtain authentication information from other legitimate users.

Solution

Apply the relevant support package to address this vulnerability.

Reason and prerequisites

Pages within the ITS do not sufficiently encode input parameters, resulting in a reflected cross site scripting vulnerability. An attacker can use this vulnerability to:

• Non-permanently deface or modify website content.
• Steal another user's authentication information, such as session data.
• Impersonate users, potentially leading to a full compromise of the application's security, especially if an administrator's account is targeted.

References

• Follow-on correction for SAP Note 1774690
• ITS: ~design* and masking (SAP Note 1877331)
• Automatic checks for security notes using RSECNOTE (SAP Note 888889)