Unauthorized modification of displayed content in BSP Demo, SAP security note 1488596

SAP security note 1488596, "Unauthorized modification of displayed content in BSP Demo", was released on 19.04.2012. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Business Server Page (BSP) application WebDynproDemos can be exploited by a malicious user to modify displayed application content without authorization. This vulnerability may allow the attacker to obtain authentication information from other legitimate users.

Solution

Implement the correction instructions provided in this SAP Note or delete the BSP application WebDynproDemos to mitigate the vulnerability.

Reason and prerequisites

Pages within the BSP application WebDynproDemos do not sufficiently encode output parameters, resulting in a reflected cross-site scripting (XSS) vulnerability. An attacker can use this vulnerability to non-permanently deface or modify displayed content on the website, steal another user’s authentication information such as session data, and impersonate users, potentially gaining access to sensitive information and compromising application security if an administrator is targeted.

References

• Update #1 for Security Note 1488596
• Automatic checks for security notes using RSECNOTE (outdated)

Affected components

• SAP_BASIS: Versions 700 to 702, 710 to 730, 72L