SAP security note 2623846, "[CVE-2018-2452] Cross Site Scripting in NW AS Java Logon Application", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The logon application of NW AS Java does not sufficiently encode user-controlled inputs, resulting in a cross-site scripting (XSS) vulnerability. This vulnerability can lead to:
- Defacing or modifying displayed content impermanently from a website
- Stealing user authentication information such as session data
- Impersonating the user and accessing information with the same privileges
Solution
Apply the corrective measures as outlined in the "Validity" and "Patch Level" sections of SAP Note 2623846. Ensure that you install the relevant support package patches for your specific software component version.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Referenced by
- SAP Note 2674861 – Collective Note: SAP NetWeaver 7.5 SP13 – Application Server Java (AS Java)
Affected components
- J2EE-APPS 7.10 to 7.11
- J2EE-APPS 7.20
- J2EE-APPS 7.30
- J2EE-APPS 7.31
- J2EE-APPS 7.40
- J2EE-APPS 7.50
Full note on SAP: SAP Support Launchpad note 2623846
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].