Unauthorized modification of stored content in Forums, SAP security note 1572085

SAP security note 1572085, "Unauthorized modification of stored content in Forums". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Forums application can be abused by a malicious user, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.

Solution

There are no workarounds for this issue. To resolve it, download and deploy the Security Correction Assistant (SCA) from the "SP Patch Level" tab of this SAP note.

Reason and prerequisites

The Forums application (component BC-COM-FOR) has a stored cross-site scripting (XSS) vulnerability. This issue allows malicious users to permanently modify displayed content on a website, embed malicious content that is automatically rendered, and steal authentication information from other users. This can lead to impersonation and unauthorized access to user data.

References

• 1611223 – KMC in EHP1 for SAP NetWeaver 7.0 SPS10 – Add-on
• 1605858 – KMC in SAP NetWeaver 7.0 SPS25 – Add-on Components
• 1589209 – KMC in EHP2 for SAP NetWeaver 7.02 SPS8 – Add-on
• 1514807 – KMC in EHP2 for SAP NetWeaver 7.02 SPS7 – Add-on
• 1494031 – Portal Add-On in SAP EHP2 for SAP NetWeaver 7.0 SPS06
• 1455671 – Portal Add-on for SAP NetWeaver 7.0 EHP2 SPS05

Affected components

• BC-COM-FOR (Forums), versions 7.00 to 7.02, 7.30