Unauthorized modification of stored content in Application Integration Transaction JavaGui component, SAP security note 1941796

SAP security note 1941796, "Unauthorized modification of stored content in Application Integration Transaction JavaGui component", is a program error note released on 13.05.2014. Below are the symptom and SAP recommended solution.

Description

Symptom

Transaction JavaGui component can be abused by an attacker, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

Refer to the SP Patch level link to view the versions including the fix: SP Patch level.

Reason and prerequisites

The vulnerability allows a potential attacker to execute an XSS attack. The vulnerability exists because of insufficient URL input processing in the application com.sap.portal.appintegrator (component: Transaction JavaGui). A remote user can use a specific forged request to execute arbitrary script code in the victim’s browser, related to the security of the vulnerable website.

CVSS

Score 4.3 Vector: AV:N/AC:M/AU:N/C:N/I:P/A:N