SAP Security Note
Medium priority
SAP security note 2907781, "[CVE-2020-6257] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform (CMC and BI launchpad)", is a program error note released on 12.05.2020. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP Business Objects Business Intelligence Platform (CMC and BI Launchpad) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting vulnerability. An attacker needs some privileges for successful exploitation.
Impacts of Cross-Site Scripting vulnerability:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Proper encoding has been implemented to address the vulnerability.
This issue is fixed in the patches listed in the "Support Packages & Patches" section below.
CVSS
Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2907781
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].