Unauthorized modification of stored content in BC-SRV-KPR, SAP security note 1579673

SAP security note 1579673, "Unauthorized modification of stored content in BC-SRV-KPR", is a program error note released on December 14, 2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The BC-SRV-KPR-DMF can be abused by a malicious user to modify application content and persist the changes without authorization. This can potentially allow an attacker to obtain authentication information from other legitimate users.

This security vulnerability involves a Stored Cross Site Scripting (XSS) issue within the BC-SRV-KPR-DMF. It allows attackers to:

• Permanently modify displayed content on a website.
• Embed malicious content that executes automatically, targeting multiple users.
• Steal authentication information, potentially leading to session hijacking and full compromise of the application’s security if administrative credentials are targeted.

Solution

Implement the corrections as outlined in SAP Note 1579673 or import the relevant support package.

References

• Update #1 to Security Note 1579673 (1707298)
• Update #2 to Security Note 1579673 (1678072)
• Automatic checks for security notes using RSECNOTE (888889)

Affected components

• SAP_BASIS 620 to 640
• SAP_BASIS 700 to 702
• SAP_BASIS 710 to 730
• SAP_BASIS 731 to 800