SAP security note 2621395, "[CVE-2018-2444] Cross-Site Scripting (XSS) vulnerability in SAP Financial Consolidation". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Financial Consolidation does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to:
- Deface or modify displayed content on a website
- Steal authentication information, such as session data
- Impersonate users and access information with the same permissions as the targeted user
Solution
To address this XSS vulnerability, apply the following patches:
- SAP FC 10.0 SP19 Patch6
- SAP FC 10.1 SP06
Ensure that the members are encoded before being injected into the ASPX page to prevent the execution of malicious scripts.
Reason and prerequisites
User must be authenticated before exploitation.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- FINANCE 1000 to 1000+
- FINANCE 1010 to 1010+
Full note on SAP: SAP Support Launchpad note 2621395
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
