SAP security note 2026763, “Unauthorized modification of stored content in webcuif”, is a note. Below is the security information published by SAP for this note.
Description
Webcuif can be abused by an attacker, allowing them to modify application content, persist the modified content without authorization, and potentially obtain authentication information from other legitimate users.
Reason and prerequisites
The Webcuif business text framework <thtmlb:btf> can result in a stored cross-site scripting issue. This vulnerability allows attackers to permanently modify displayed content on a website, embedding content that is rendered automatically without targeting victims individually. Additionally, stored cross-site scripting can be used to steal another user's authentication information, such as session data. An attacker who gains access to this data may impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
Solution
To resolve the cross-site scripting issue in SAP applications that display and process HTML documents, you need to install the relevant support package or implement the correction instructions listed in this note.
- Download for SNOTE
- PDF Version
Affected components
| Software Component | From | To | |——————–|——|—-| | CRMUIF | 600 | 600| | WEBCUIF | 700 | 700| | WEBCUIF | 701 | 701| | WEBCUIF | 730 | 730| | WEBCUIF | 731 | 731| | WEBCUIF | 746 | 746| | WEBCUIF | 747 | 747|
References
Full note on SAP: SAP Support Launchpad note 2026763
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].