SAP security note 1501403, "Unauthorized modification of displayed content in SEM CPM", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The SEM CPM (Strategic Enterprise Management Corporate Performance Monitor) is vulnerable to a reflected Cross-Site Scripting (XSS) attack. A malicious user could exploit this vulnerability to modify displayed application content without authorization and potentially steal authentication information from other legitimate users. This could lead to unauthorized access and full compromise of the application’s security if an administrator is impersonated.
Solution
Implement the correction instructions provided in SAP Note 1501403 using transaction SNOTE. This will address the XSS vulnerability and prevent unauthorized content modification.
CVSS
Score 0
Affected components
- SEM-BW (Versions: 400, 600, 602, 603, 604, 605, 634, 700)
Full note on SAP: SAP Support Launchpad note 1501403
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].