CVE-2019-0281 Cross-Site Scripting (XSS) vulnerability in SAPUI5 and OpenUI5, SAP security note 2756539

SAP security note 2756539, "[CVE-2019-0281] Cross-Site Scripting (XSS) vulnerability in SAPUI5 and OpenUI5". Below are the symptom and SAP recommended solution.

Description

Symptom

OpenUI5 does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Impacts of XSS vulnerability include:

• Non-permanently defacing or modifying displayed content on a website
• Stealing authentication information of the user, such as data relating to their current session
• Impersonating the user and accessing all information with the same rights as the target user

Solution

Untrusted input appended to the DOM is now correctly encoded using the provided framework functions.

Corrections are available from the following versions:

For SAPUI5: 1.63.1, 1.60.8, 1.52.28, 1.44.44, 1.38.40.
For OpenUI5: 1.63.1, 1.60.8, 1.52.26, 1.44.40, 1.38.40.

For SAP HANA Platform: Update to the specified Support Package Patches for various components.

Reason and prerequisites

You are using SAPUI5 release 1.30 or higher. The issue is not present in SAPUI5 release 1.28 and below.

Affected Releases

SAPUI5 Releases: 1.30 ≤ 1.38.39, 1.30 ≤ 1.44.43, 1.30 ≤ 1.52.27, 1.30 ≤ 1.60.6, 1.30 ≤ 1.63.0.
OpenUI5 Releases: 1.30 ≤ 1.38.39, 1.30 ≤ 1.44.39, 1.30 ≤ 1.52.25, 1.30 ≤ 1.60.6, 1.30 ≤ 1.63.0.

CVSS

Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N