SAP security note 2637997, "[CVE-2019-0303] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Administration Console)". Below are the symptom and the SAP recommended solution.
Description
Symptom
SAP BusinessObjects BI Administration Console does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerabilities include:
- Non-permanently defacing or modifying displayed content from a website
- Stealing authentication information of the user, such as data relating to their current session
- Impersonating the user and accessing all information with the same rights as the target user
Solution
The vulnerable URL parameter is now properly encoded.
This issue is addressed in the patches listed in the "Support Packages & Patches" section below. The "Support Packages & Patches" section will be updated with the relevant patch levels once they are released.
For the Business Intelligence Platform maintenance schedule and strategy, refer to Knowledge Base Article 2144559.
Reason and prerequisites
Environment: SAP BusinessObjects Business Intelligence Platform (BI 4.2) Support Pack (SP) 05 and above.
Certain SAP Business Objects JSP pages do not properly sanitize some parameters, allowing scripts to be executed as a result. An attacker could exploit this by crafting a special URL that executes custom JavaScript code when accessed.
CVSS
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2637997
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].