SAP Security Note
High priority
SAP security note 1458310, "Unauthorized modification of displayed content in InfoView", was released on 12.10.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
The InfoView application could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information from other legitimate users.
Solution
Customers should install XIR3 FP2.9 or FP3.1.
Reason and prerequisites
A page within InfoView does not sufficiently encode input parameters, resulting in a reflected cross-site scripting issue. An attacker can use this to non-permanently deface or modify displayed content or steal authentication information to impersonate users, potentially compromising application security.
Full note on SAP: SAP Support Launchpad note 1458310
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
