Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Java Archiving Framework, SAP security note 2308535

SAP Note 2308535
Medium priority

SAP security note 2308535, "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Java Archiving Framework", was released on April 11, 2017. Below are the symptom, SAP recommended solution and the affected software components.

PriorityCorrection with medium priority
StatusReleased for Customer
Released onApril 11, 2017

Description

Symptom

Java Archiving Framework does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Impacts of XSS Vulnerability:

  • Non-permanently deface or modify displayed content from a website.
  • Steal authentication information of the user, such as session data.
  • Impersonate the user and access information with the same rights as the target user.

Solution

  • Code lines causing the issue have been removed.
  • Implement the relevant Support Packages.

CVSS

Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected components

  • J2EE ENGINE APPLICATIONS versions 7.10 to 7.50

Full note on SAP: SAP Support Launchpad note 2308535

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XSS #Java Archiving Framework #J2EE #NetWeaver

Explore More