SAP security note 2408100, "Cross-Site Scripting (XSS) vulnerability in Enterprise Portal – GenericSemanticTest component", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The GenericSemanticTest component in Enterprise Portal does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some known impacts of XSS vulnerabilities include:
- Non-permanently defacing or modifying displayed content on a website
- Stealing user authentication information, such as session data
- Impersonating the user to access information with the same rights as the target user
Solution
The vulnerable code has been removed.
Reason and prerequisites
Reason: Data was printed to the screen without encoding.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2408100
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].