SAP security note 2419559, “Reflected Cross-Site Scripting (XSS) in Web Intelligence BI Launchpad”. Below are the symptom and SAP recommended solution.
Description
Symptom
Web Intelligence BI Launchpad does not sufficiently encode user-controlled inputs in workflows involving date validation, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability include:
- Non-permanently defacing or modifying displayed content on a website
- Stealing authentication information of the user, such as data relating to their current session
- Impersonating the user and accessing all information with the same rights as the target user
Solution
User entries validation has been improved for the impacted pages.
This issue is fixed in the patches listed in the “Support Packages & Patches” section below. The “Support Packages & Patches” section will be populated with the relevant patch levels once they are released.
For the Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559 in the References section.
Reason and prerequisites
This vulnerability is due to poor validation of user entries, and users must be logged in before this vulnerability can be exploited.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2419559
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].