SAP security note 2478964, "Cross-Site Scripting (XSS) vulnerability in SAP CRM Internet Sales Administration Console". Below are the symptom and SAP recommended solution.
Description
Symptom
SAP CRM-Internet Sales Administration Console does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website.
- Steal authentication information of the user, such as data relating to their current session.
- Impersonate the user and access all information with the same rights as the target user.
Solution
This note contains Java Correction(s) for E-Commerce / Web Channel.
Implement the SP Patch Level attached to this note.
For further information about installing Java Patches, consult note 877887. Information about the patch strategy can be found in note 1546959.
Reason and prerequisites
Insufficient output encoding.
CVSS
Score 6.1
References
Full note on SAP: SAP Support Launchpad note 2478964
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
