SAP security note 1684640, “Unauthorized modification in BSP applications in IS-M”, is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A malicious user can exploit IS-M BSP applications to modify displayed content without authorization and potentially steal authentication information from legitimate users.
Solution
Apply this SAP Security Note 1684640 or import the changes via the relevant support package appropriate for your IS-M version.
Reason and prerequisites
Cross-Site Scripting (XSS) vulnerability allows attackers to impersonate users, including administrators, leading to potential full compromise of application security.
References
- BSP: Design2008 for release 7.00 and 7.01
- ABAP XSS Escaping Support
- Security options (XSS) for ESCAPE
- Kampagnengestützte Auftragsanlage: Erweiterte Funktionalität
Affected components
- IS-M 471, 472, 600, 602, 603, 604, 605, 606, 616
Full note on SAP: SAP Support Launchpad note 1684640
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].