High priority
SAP security note 1668176, "Unauthorized modification of SICF handler in SRM-EBP-CA-UI", is a program error note released on June 12, 2012. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A vulnerability exists in SRM-EBP-CA-UI that allows malicious users to modify application content without authorization and potentially obtain authentication information from other legitimate users through cross-site scripting (XSS). This issue arises from insufficient encoding of output parameters in SICF Handlers. Successful exploitation could enable attackers to impersonate users, including administrators, thereby compromising the security of the application.
Solution
Apply SAP Security Note 1668176 via SNOTE or import the necessary changes through the relevant support packages.
Affected components
- SRM_SERVER versions 700, 701, 702
Full note on SAP: SAP Support Launchpad note 1668176
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
