SAP Security Note
Medium priority
SAP security note 2696714, "[CVE-2019-0262] Cross-Site Scripting (XSS) vulnerability in WebIntelligence BILaunchPad", is a program error note released on 12.02.2019. Below are the symptom and SAP recommended solution.
Description
Symptom
WebIntelligence BILaunchPad does not sufficiently encode user-controlled inputs in generated HTML reports, resulting in a Cross-Site Scripting (XSS) vulnerability. Potential impacts include:
- Content Modification: Non-permanently deface or modify displayed content from a website.
- Information Theft: Steal authentication information of the user, such as data related to their current session.
- User Impersonation: Impersonate the user and access all information with the same rights as the target user.
Solution
Encode and enclose user inputs when generating HTML reports. This issue is fixed in the patches listed in the Support Packages & Patches section below. For the Business Intelligence Platform maintenance schedule and strategy, refer to SAP Note 2144559.
Reason and prerequisites
User inputs are not sufficiently encoded and enclosed when generating HTML reports.
CVSS
Score 4.1 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:N/A:N
References
Full note on SAP: SAP Support Launchpad note 2696714
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
