SAP security note 2396544, "Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence HTML interface". Below are the symptom and SAP recommended solution.
Description
Symptom
SAP BusinessObjects Web Intelligence HTML interface does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. This can lead to:
- Non-permanent defacement or modification of displayed content on a website.
- Theft of user authentication information, such as session data.
- Impersonation of the user to access information with the same privileges as the target user.
Solution
User input text is now properly encoded and interpreted as text values, mitigating the XSS vulnerability.
The "Support Packages & Patches" section will be updated with the relevant patch levels once they are released. For the Business Intelligence Platform maintenance schedule and strategy, refer to Knowledge Base Article 2144559.
CVSS
Score 7.1 Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2396544
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].