SAP security note 1496707, "Unauthorized modification of displayed content in PLM-CFO". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The PLM-CFO can be abused by a malicious user to modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
For more detailed information, see Security Notes 1593294 and 1613163.
Solution
Apply the correction instructions provided here: Correction Instructions.
Reason and prerequisites
Pages within the PLM-CFO do not sufficiently encode input and output parameters, resulting in a reflected XSS issue. A reflected XSS attack can be used to non-permanently deface or modify displayed content from a website.
Additionally, reflected XSS can be used to steal another user's authentication information, such as data related to their current session. An attacker who gains access to this data may impersonate the user and access all information with the same rights as the target user. In the case of an administrator being impersonated, a full compromise of the application's security may occur.
References
Affected components
- CPRXRPM (500_702 to 500_702)
Full note on SAP: SAP Support Launchpad note 1496707
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
