Skip links

Adaption of applications using NW BTF Editor, SAP security note 1634348

Description

Some functions in the Employee Interaction Center that use the BTF editor can be abused by a malicious user, allowing them to modify
application content, persist the modified content without authorization, and to potentially obtain authentication information from other legitimate users.

Available fix and Supported packages

  • EA-HRGXX | 602 | 602
  • EA-HRGXX | 603 | 603
  • EA-HRGXX | 604 | 604
  • EA-HRGXX | 605 | 605
  • EA-HRGXX | 606 | 606
  • EA-HRGXX 603 | SAPK-60348INEAHRGXX |
  • EA-HRGXX 605 | SAPK-60517INEAHRGXX |
  • EA-HRGXX 602 | SAPK-60253INEAHRGXX |
  • EA-HRGXX 604 | SAPK-60440INEAHRGXX |
  • EA-HRGXX 606 | SAPK-60602INEAHRGXX |

Affected component

    PA-EIC
    Employee Interaction Center

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1634348

TAGS

#HREIC
#Stored-Cross-site-scripting
#XSS
#CSS