SAP security note 2592807, "[CVE-2018-2399] Cross-Site Scripting (XSS) Vulnerability in Process Monitoring Infrastructure", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Process Monitoring Infrastructure (PMI) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability can lead to:
- Non-permanent defacement or modification of displayed content on a website
- Theft of user authentication information, such as session data
- Impersonation of users, allowing access with the same rights as the target user
Solution
- Upgrade: Please upgrade to the latest Support Package or deploy a patch with the appropriate patch level. The minimum patch level information is provided in the "SP Patch Level" section of this note.
- Temporary Workaround: As a temporary measure, you can safely undeploy tc~pmi~test.
Reason and prerequisites
The SAP Java Web Application tc~pmi~test reflects POST-requested parameter values into response content without proper sanitization.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- CVE-2018-2399
Full note on SAP: SAP Support Launchpad note 2592807
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
