SAP security note 1694057, "Unauthorized modification of displayed content in PLM-CFO". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The PLM-CFO component is susceptible to reflected XSS attacks due to insufficient encoding of input and output parameters. This flaw allows attackers to non-permanently deface or modify web content and steal user session data.
Solution
To mitigate this vulnerability, apply the correction instructions provided in this SAP Security Note.
Reason and prerequisites
Exploitation of this vulnerability can lead to unauthorized access, data theft, and potential full compromise of the application’s security, especially if an administrator’s credentials are targeted. Prerequisites: SAP Note 1661780 and SAP Note 1694056.
References
- SAP Note 2201881 – Update 1 for Security Note 1694057
- SAP Note 1694081 – Unauthorized modification of displayed content in PLM-CFO
Affected components
- CPROJECTS: 310_620 to 310_640
- CPRXRPM: 400, 450_700, 500_702
Full note on SAP: SAP Support Launchpad note 1694057
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].