SAP security note 2863743, "[CVE-2020-6305] Cross-Site Scripting (XSS) vulnerability in Rest Adapter of SAP Process Integration". Below are the symptom and SAP recommended solution.
Description
Symptom
The Rest Adapter in SAP Process Integration does not sufficiently encode user-controlled inputs, leading to an XSS vulnerability. Potential impacts include:
- Defacing or modifying displayed content on a website.
- Stealing user authentication information, such as session data.
Solution
This vulnerability has been addressed with the Support Packages and Patches referenced in this SAP Security Note. Applying the patch to the Rest Adapter of SAP NetWeaver Process Integration restricts trace information (e.g., debug traces) to internal administrators, preventing malicious users from exploiting this information.
Reason and prerequisites
To exploit this vulnerability, an attacker must trick the victim into clicking a malicious link. Additionally, the victim must have certain privileges to access the vulnerable page.
CVSS
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2863743
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].