Unauthorized modification of displayed content, SAP security note 1583235

SAP Note 1583235SAP Security NoteHigh priority

SAP security note 1583235, "Unauthorized modification of displayed content", released on June 14, 2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentBasis Components > Business Server Pages (BC-BSP)

PriorityCorrection with high priority

TypeSAP Security Note

Released onJune 14, 2011

Description

Symptom

The BSP sample application can be exploited by a malicious user to modify displayed application content without authorization. This vulnerability allows attackers to potentially steal authentication information from legitimate users, leading to session impersonation and full compromise of the application's security.

Solution

Apply the relevant support package for your SAP_BASIS version, or deactivate the ICF node for the BSP sample application.

CVSS

Score 0

References

Automatic checks for security notes using RSECNOTE (outdated) – SAP Note 888889

Affected components

SAP_BASIS versions 620 to 640
SAP_BASIS versions 700 to 702
SAP_BASIS versions 710 to 730

Full note on SAP: SAP Support Launchpad note 1583235

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Business Server Pages #BSP #BC-BSP