Unauthorized modification of displayed content in RA, SAP security note 1637404

SAP security note 1637404, "Unauthorized modification of displayed content in RA", is a note released on 14.02.2012. Below are the symptom, SAP recommended solution and reason and prerequisites.

Description

Symptom

Returns Authorization can be abused by an attacker, allowing them to modify displayed application content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

This vulnerability has been corrected in RA versions 2.6 and 2.7.

Reason and prerequisites

The Lowest Price Maintenance Screen within the Administration Menu of the Returns Authorization Web Application does not sufficiently encode output parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. This can be exploited to deface or modify displayed content and steal user authentication information.