SAP security note 2366726, "Cross-Site Scripting (XSS) Vulnerability in PI Integration Engine", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
PI Integration Engine does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Non-permanently deface or modify displayed content from a website.
Steal authentication information of the user, such as data relating to their current session.
Impersonate the user and access all information with the same rights as the target user.
Solution
The URL parameters are now properly encoded to prevent a successful XSS attack.
Implement the Support Packages and Patches referenced by this SAP Note.
There are no known impacts on existing functionalities after implementing the security note.
Reason and prerequisites
There is a Cross-Site Scripting issue in the URL for configuring Alert Rules.
CVSS
Score 6.1 / 10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- SAP_BASIS 700 – 702
- SAP_BASIS 710 – 711
- SAP_BASIS 730
- SAP_BASIS 731
- SAP_BASIS 740
- SAP_BASIS 750 – 751
Full note on SAP: SAP Support Launchpad note 2366726
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].