SAP security note 2412897, "Cross-Site Scripting (XSS) vulnerability in Enterprise Portal". Below are the symptom and SAP recommended solution.
Description
Symptom
Enterprise Portal does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerabilities include:
- Non-permanently defacing or modifying displayed content on a website
- Stealing authentication information of the user, such as data relating to their current session
- Impersonating the user and accessing all information with the same rights as the target user
Solution
The URL parameters are now properly encoded to prevent successful XSS attacks.
Under the "Support Packages & Patches" tab within this note, you can check for the appropriate Support Package (SP) and Patch level that fixes this issue.
CVSS
Score 4.8 Vector: AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2412897
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].