CVE-2019-0321 Cross-Site Scripting (XSS) vulnerability in ABAP Server and ABAP Platform, SAP security note 2773888

SAP security note 2773888, "[CVE-2019-0321] Cross-Site Scripting (XSS) vulnerability in ABAP Server and ABAP Platform". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

ABAP Server and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

• Non-permanently deface or modify displayed content from a website
• Steal authentication information of the user, such as data relating to their current session
• Impersonate the user and access all information with the same rights as the target user

Solution

Please implement the correction provided by this SAP Note.

Reason and prerequisites

URLs containing malicious characters are not handled correctly.

CVSS

Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected components

• SAP_BASIS 731
• SAP_BASIS 740
• SAP_BASIS 750 to 753
• SAP_BASIS 776