SAP security note 2679378, "[CVE-2018-2464] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver WebDynpro Java". Below are the symptom and SAP recommended solution.
Description
Symptom
WebDynpro Java does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.
Non-permanently defacing or modifying displayed content from a website.
Stealing authentication information of the user, such as data relating to their current session.
Impersonating the user and accessing all information with the same rights as the target user.
Solution
The URL parameters are now sufficiently encoded. Please apply the patches as mentioned in the Support Packages & Patches section below.
CVSS
Score 6.1 / 10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2679378
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].