Medium priority
SAP security note 2900374, “[CVE-2020-6229] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP (Business Server Pages application CRM_BSP_FRAME)”, was released on April 13, 2020. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Note 2900374 addresses a Cross-Site Scripting (XSS) vulnerability in the Business Server Pages (BSP) application CRM_BSP_FRAME within SAP NetWeaver AS ABAP. The application does not sufficiently encode user-controlled inputs, allowing attackers to inject malicious scripts.
Exploitation of this vulnerability allows attackers to:
- Deface or modify displayed content on the website.
- Steal authentication information, such as session data.
- Impersonate users and access information with the same privileges as the target user.
Solution
The vulnerability has been addressed by properly encoding URL parameters to prevent successful XSS attacks. The issue is fixed in the patches listed in the “Support Packages & Patches” section of the SAP Note.
CVSS
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- SAP_ABA 700 to 752, and 75A to 75E
Full note on SAP: SAP Support Launchpad note 2900374
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].