Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Unauthorized modification of stored content in NW KMC, SAP security note 1477597

SAP Note 1477597SAP Security NoteHigh priority

SAP security note 1477597, "Unauthorized modification of stored content in NW KMC", is a program error note released on 05.08.2016. Below are the symptom and SAP recommended solution.

ComponentEnterprise Portal > Enterprise Portal – Knowledge Management and Collaboration > Content Management
CategoryProgram error
PriorityCorrection with high priority
TypeSAP Security Note
Version6
StatusReleased for Customer
Released on05.08.2016
LanguageEnglish

Description

Symptom

The KMC resources like HTML and text documents can be abused by a malicious user allowing them to modify application content, and persist the modified content without authorization and to potentially obtain authentication information from other legitimate users.

Solution

A.) The issue is cleared in these deliveries:

  • Patch 4 for KMC CONTENT MANAGEMENT 6.40 SP 23
  • Patch 1 for KMC CONTENT MANAGEMENT 6.40 SP 24
  • Patch 1 for KMC CONTENT MANAGEMENT 6.40 SP 25
  • Patch 1 for KMC CONTENT MANAGEMENT 6.40 SP 26
  • Patch 4 for KMC CONTENT MANAGEMENT 7.00 SP 19
  • Patch 3 for KMC CONTENT MANAGEMENT 7.00 SP 20
  • Patch 2 for KMC CONTENT MANAGEMENT 7.00 SP 21
  • Patch 1 for KMC CONTENT MANAGEMENT 7.00 SP 22
  • Patch 1 for SAP EHP1 FOR SAP NETWEAVER 7.0 SP4
  • Patch 2 for SAP EHP1 FOR SAP NETWEAVER 7.0 SP5
  • Patch 2 for SAP EHP1 FOR SAP NETWEAVER 7.0 SP6
  • SAP EHP1 FOR SAP NETWEAVER 7.0 SP7
  • SAP EHP1 FOR SAP NETWEAVER 7.0 SP8
  • Patch 1 for SAP EHP2 FOR SAP NETWEAVER 7.0 SP3
  • Patch 1 for SAP EHP2 FOR SAP NETWEAVER 7.0 SP4
  • SAP EHP2 FOR SAP NETWEAVER 7.0 SP5
  • SAP NETWEAVER 7.30 SP1

See SP Stack Schedule for schedule details and updates.

B.) Possible workaround before the release of mentioned deliveries: None

Reason and prerequisites

Pages resulting in a stored cross site scripting issue.

It can be used to permanently modify displayed content from a website, allowing the malicious user to embed content that is rendered automatically, without the need to individually target victims.

Stored cross site scripting can also be used to steal another user’s authentication information such as data relating to their current session.

An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user. In case of an administrator being impersonated, a full compromise of the application’s security may occur.

References

Full note on SAP: SAP Support Launchpad note 1477597

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Stored Cross Site Scripting#XSS#KMC resources

Explore More