SAP Security Note
High priority
SAP security note 1484104, "Unauthorized modification of displayed content in FCC", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A stored Cross Site Scripting (XSS) vulnerability has been identified in the CRM-IC-FCA component (Customer Relationship Management > Interaction Center WebClient > Contract Accounting). This vulnerability allows malicious users to abuse URL parameters to modify application content without authorization. This can lead to persistent XSS attacks, potentially allowing attackers to steal authentication information or impersonate users, including administrators.
Solution
Implement the attached correction instructions or import the corresponding Support Package.
Affected components
- BBPCRM 500
- BBPCRM 520
- BBPCRM 600
- BBPCRM 700
- BBPCRM 701
Full note on SAP: SAP Support Launchpad note 1484104
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
