SAP Security Note
High priority
SAP security note 1610466, "Unauthorized Modification of Displayed Content in TEST_SRT", is a program error note released on 16.01.2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The TEST_SRT report can be exploited by a malicious user to modify the content displayed by the application without proper authorization. Additionally, attackers may obtain sensitive authentication information from other legitimate users, which can lead to session hijacking and unauthorized access. In scenarios where an administrator’s credentials are compromised, the application’s security could be fully breached.
- Attack Vector: Reflected Cross-Site Scripting (XSS)
- Impact: Confidentiality and Integrity
Solution
To mitigate this vulnerability, apply the relevant support package mentioned in SAPKB1610466 or follow the provided correction instructions. Ensure that all applicable SAP_BASIS versions are updated accordingly.
CVSS
Score 0 (Not properly assessed)
References
Affected components
- SAP_BASIS 701
- SAP_BASIS 702
- SAP_BASIS 711
- SAP_BASIS 720
- SAP_BASIS 730
- SAP_BASIS 731
Full note on SAP: SAP Support Launchpad note 1610466
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].