Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Site Scripting (XSS) vulnerability in SAP Travel Management, SAP security note 2417428

SAP Note 2417428
SAP Security Note
Medium priority

SAP security note 2417428, "XSS Vulnerability in SAP Travel Management", is a program error note released on 14.03.2017. Below are the symptom and SAP recommended solution.

ComponentFinancial Accounting > Business Trip Management > Trip Costs
CategoryProgram error
PriorityCorrection with medium priority
TypeSAP Security Note
Version2
StatusReleased for Customer
Released on14.03.2017
LanguageEnglish

Description

Symptom

SAP Travel Management does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Impacts of XSS vulnerability:

  • Non-permanently deface or modify displayed content from a website
  • Steal authentication information of the user, such as data relating to their current session
  • Impersonate the user and access all information with the same rights as the target user

Solution

The fields customer and location are now properly escaped.

CVSS

Score 5.4 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Full note on SAP: SAP Support Launchpad note 2417428

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XSS #Cross-Site Scripting #SAP Travel Management #Trip Costs

Explore More