Unauthorized use of application functions in WEBCUIF, SAP security note 1772190

SAP security note 1772190, "Unauthorized use of application functions in WEBCUIF", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker can execute functions in WEBCUIF without authentication and authorization.

Solution

Please implement the attached correction instructions or install the corresponding support package.

Reason and prerequisites

WEBCUIF executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user. The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.

Side effects

This document is causing side effects: 1969191 – Sorting of Column in SUS not possible

CVSS

Score 0

Affected components

• WEBCUIF: 700, 701, 730, 731, 746