Unauthorized use of application functions in SLD, SAP security note 2240548

SAP security note 2240548, "Unauthorized use of application functions in SLD". Below are the symptom and SAP recommended solution.

Description

Symptom

An attacker can execute functions in SLD without authentication and authorization.

Solution

Update your AS Java to an SP or release where the issue is fixed. See the SP Patch Level section for details and available patches.

Reason and prerequisites

SLD executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user’s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.

References