Description
This security note address two security issues which are as given below.
1. The HTML files of the BSP Application WebDocuments is vulnerable to Cross Site Scripting. This can be done by embedding HTML into a page that someone else will open. The application could be abused by a malicious user, who could modify displayed application content without authorization and potentially obtain authentication information fromother legitimate users.
2. WebDocuments does not have the logoff feature and session management which might lead to session hijacking.
Available fix and Supported packages
- EA-APPL | 110 | 110
- EA-APPL | 200 | 200
- EA-APPL | 500 | 500
- EA-APPL | 600 | 600
- EA-APPL | 602 | 602
- EA-APPL | 603 | 603
- EA-APPL | 604 | 604
- EA-APPL | 605 | 605
- EA-APPL 500 | SAPKGPAC24 |
- EA-APPL 600 | SAPKGPAD19 |
- EA-APPL 602 | SAPK-60209INEAAPPL |
- EA-APPL 603 | SAPK-60308INEAAPPL |
- EA-APPL 604 | SAPK-60409INEAAPPL |
- EA-APPL 605 | SAPK-60503INEAAPPL |
- EA-APPL 110 | SAPKGPAA32 |
- EA-APPL 200 | SAPKGPAB21 |
Affected component
- CA-DMS
Document management
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1505976
