Cross-Site Scripting (XSS) vulnerability in ecattping, SAP security note 2256178

SAP security note 2256178, "Cross-Site Scripting (XSS) vulnerability in ecattping", is a program error note released on 14.06.2016. Below are the symptom, SAP recommended solution, reason and prerequisites, the CVSS score, the affected software components, and references.

Description

Symptom

ecattping does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are:

• Non-permanently deface or modify displayed content from a Web site
• Steal authentication information of the user, such as data relating to their current session
• Impersonate the user and access all information with the same rights as the target user

Solution

Please update the component ecattping with the referenced patch version.

Reason and prerequisites

Error handling within ecattping does not sufficiently encode output parameters, leading to a reflected cross-site scripting issue. A reflected XSS attack can be used to non-permanently deface or modify displayed content on a website.

Reflected XSS can be used to steal another user’s authentication information, such as data relating to their current session. An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.

CVSS

Score 6.1/10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected components

• FRAMEWORK 7.10 to 7.11
• FRAMEWORK 7.20
• FRAMEWORK 7.30
• FRAMEWORK 7.31
• FRAMEWORK 7.40
• FRAMEWORK 7.50

References