SAP security note 1478696, "Cross Site Scripting Protection Enhancement", is a note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The SAP Enterprise Portal can be exploited by malicious users, allowing unauthorized modification of application content. This vulnerability enables attackers to perform stored cross-site scripting (XSS) attacks, which can lead to the permanent alteration of displayed content on a website.
Malicious users can embed content that is automatically rendered without targeting individual victims, potentially stealing authentication information such as session data. This information can be used to impersonate users, and if an administrator is targeted, it may result in a full compromise of the application’s security.
Solution
Enhancement of the cross-site scripting blocking mechanisms to prevent unauthorized content modifications and protect authentication information from being compromised.
Affected components
- SAP NetWeaver 7.00 SP18 and below
- SAP NetWeaver 7.10 SP9 and below
- SAP NetWeaver 7.11 SP4 and below
- Enterprise Portal
- Page Builder
- Portal Runtime
- Application Integration
Full note on SAP: SAP Support Launchpad note 1478696
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].