SAP security note 2771221, "[CVE-2019-0334] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (BI Workspace)", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Business Objects Platform does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Exploiting this XSS vulnerability can lead to:
- Non-permanently defacing or modifying displayed content from a website.
- Stealing authentication information of the user, such as data relating to their current session.
- Impersonating the user and accessing all information with the same rights as the target user.
Solution
Output encoding techniques have been implemented to prevent XSS in this application. This issue is fixed in the patches listed below.
CVSS
Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
Affected components
- ENTERPRISE 410
- ENTERPRISE 420
- ENTERPRISE 430
Full note on SAP: SAP Support Launchpad note 2771221
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].