Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Authentication and SSO, SAP security note 2443586

SAP Note 2443586

SAP security note 2443586, "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Authentication and SSO". Below are the symptom and SAP recommended solution.

Description

Symptom

Authentication with SAML 2.0 functionality does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are:

  • Non-permanently deface or modify displayed content from a website
  • Steal authentication information of the user, such as data relating to their current session
  • Impersonate the user and access all information with the same rights as the target user

Solution

  • The URL parameters are now properly encoded to prevent a successful XSS attack.
  • Implement the Support Packages and Patches referenced by this SAP Note.

CVSS

Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Full note on SAP: SAP Support Launchpad note 2443586

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#XSS #stored XSS #reflected XSS #CSS

Explore More