Unauthorized modification of stored content in BC-SRV-RM, SAP security note 1609546

SAP security note 1609546, "Unauthorized modification of stored content in BC-SRV-RM". Below are the symptom and SAP recommended solution.

Description

Symptom

BC-SRV-RM can be abused by a malicious user, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

It is recommended to upgrade to the following Support Packages (SPs) to apply the corrections. If upgrading is not possible, please apply this note.

• Release 731: SAPKB73005
• Release 730: SAPKB73005
• Release 720: SAPKB72006
• Release 711: SAPKB71108
• Release 710: SAPKB71014
• Release 702: SAPKB70210
• Release 701: SAPKB70111
• Release 700: SAPKB70026
• Release 640: SAPKB64029
• Release 620: SAPKB62071

Reason and prerequisites

Some BSP pages in BC-SRV-RM result in a stored cross-site scripting issue. This vulnerability allows malicious users to permanently modify displayed content on a website, embedding content that is rendered automatically without targeting victims individually. Stored XSS can also be used to steal another user’s authentication information, such as data related to their current session. A malicious user who gains access to this data may impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.