SAP security note 2667103, "[CVE-2018-2472] Cross-Site Scripting (XSS) vulnerability in SAP Web Intelligence DHTML client". Below are the symptom and the SAP recommended solution.
Description
Symptom
SAP Web Intelligence DHTML client does not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Solution
This issue has been mitigated by sanitizing user inputs. For the Business Intelligence Platform maintenance schedule and strategy, see Knowledge Base Article 2144559.
Reason and prerequisites
The attacker must be logged in with a privileged user account to modify the document and insert malicious scripts.
CVSS
Score 5.4/10 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2667103
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
