SAP Note 2274286
SAP security note 2274286, "XSS Vulnerability in BI Documents Send Action", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The send option in BI documents does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
- Defacing or modifying displayed content from a website.
- Stealing authentication information of the user, such as data related to their current session.
- Impersonating the user and accessing information with the same rights as the target user.
Solution
Output encoding has been added to prevent successful XSS attacks.
CVSS
Score 5.4 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2274286
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
