Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Site Scripting (XSS) vulnerability in SAP SRM, SAP security note 1827555

SAP Note 1827555
Medium priority

SAP security note 1827555, "Cross-Site Scripting (XSS) vulnerability in SAP SRM", is released on February 12, 2019. Below are the symptom, SAP recommended solution and the affected software components.

PriorityCorrection with medium priority
StatusReleased for Customer
Released onFebruary 12, 2019

Description

Symptom

SAP SRM does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerabilities include:

  • Non-permanently defacing or modifying displayed content on a website.
  • Stealing authentication information of users, such as data related to their current session.
  • Impersonating users and accessing information with the same rights as the target user.

Solution

Implement this SAP Security Note or import the relevant Support Package into your system.

CVSS

Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Affected components

  • SRM-EBP-CA-UI (versions 600, 700, 701, 702)

Full note on SAP: SAP Support Launchpad note 1827555

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#SRM #XSS #EBP #Cross-Site Scripting

Explore More