SAP Security Note
High priority
SAP security note 2161571, "Unauthorized use of application functions in BI Workspace", is a program error note released on 08.09.2015. Below are the symptom and SAP recommended solution.
Description
Symptom
Performance Management Application can be abused by an attacker, allowing them to modify displayed application content without authorization, and to potentially obtain authentication information from other legitimate users.
Solution
The issue has been fixed in the patches listed below. Ensure you apply the relevant support package patches to mitigate this vulnerability.
Reason and prerequisites
The ViewAnalytic page within the Performance Management Application does not sufficiently encode OUTPUT parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. This can be exploited to deface or modify displayed content and steal user authentication information.
CVSS
Score 4.3 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N
References
Full note on SAP: SAP Support Launchpad note 2161571
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
