SAP security note 2607692, "[CVE-2019-0245] Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Non-permanently deface or modify displayed content from a website.
Steal authentication information of the user, such as data relating to their current session.
Impersonate the user and access all information with the same rights as the target user.
Unauthorized execution of commands.
Solution
Input encoding has been added. Please implement the solution below, or install the equivalent Support Package.
Reason and prerequisites
CRM WebClient UI does not encode or validate untrusted input. The attacker needs to trick an already authenticated user to visit a prepared website to launch the attack.
CVSS
Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
Referenced by
Affected components
- SAPSCORE: 112
- S4FND: 102
- WEBCUIF: 731, 746, 747, 748, 800, 801
Full note on SAP: SAP Support Launchpad note 2607692
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
