SAP security note 2913293, "[CVE-2020-6254] Cross-Site Scripting (XSS) vulnerability in SAP Enterprise Threat Detection", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Enterprise Threat Detection does not sufficiently encode error pages in case of errors, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
The XSS vulnerability has been fixed by output encoding of the error response pages. The fix has been made available with the Support Packages and Patches referenced by this SAP Security Note.
Reason and prerequisites
The error response pages were not properly encoded in case of errors, allowing XSS payload reflecting in the response.
CVSS
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- BC-SEC-ETD (SAP Enterprise Threat Detection)
Full note on SAP: SAP Support Launchpad note 2913293
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].