SAP Security Note
Medium priority
SAP security note 2864462, “[CVE-2020-6210] Cross-Site Scripting (XSS) vulnerability in SAP Fiori Launchpad”, was released on 14.04.2020. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Fiori Launchpad does not sufficiently encode user-controlled inputs, allowing attackers to inject meta tags into the launchpad HTML using vulnerable parameters. This results in a reflected Cross-Site Scripting (XSS) vulnerability. With a successful attack, an attacker can steal authentication information of the user, such as data relating to their current session.
Solution
Additional validation of the user parameter has been implemented to address this vulnerability. This issue is fixed in the patches listed in the “Support Packages & Patches” section below.
CVSS
Score 4.7 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N
Full note on SAP: SAP Support Launchpad note 2864462
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].