Description
SAP NetWeaver Enterprise Portal (Fiori Framework Page) does not sufficiently encode user controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the system, resulting in Cross Site Scripting.
Since the specific scenario is protected by an XSRF token, the attacker should know the token to be able to target the victim.
Some well-known impacts of XSS vulnerability are –
- Non-permanently deface or modify displayed content from a Web site
- Steal authentication information of the user, such as data relating to his or her current session
- Impersonate the user and access all information with the same rights as the target user
Available fix and Supported packages
- EP-FLP | 7.50 | 7.50
- EP-RUNTIME | 7.31 | 7.31
- EP-RUNTIME | 7.40 | 7.40
- EP RUNTIME 7.31 | SP019 | 000021
- EP RUNTIME 7.31 | SP021 | 000005
- EP RUNTIME 7.31 | SP022 | 000004
- EP RUNTIME 7.31 | SP025 | 000002
- EP RUNTIME 7.31 | SP026 | 000002
- EP RUNTIME 7.31 | SP027 | 000001
- EP RUNTIME 7.31 | SP028 | 000000
- EP RUNTIME 7.40 | SP014 | 000020
- EP RUNTIME 7.40 | SP016 | 000005
- EP RUNTIME 7.40 | SP017 | 000004
- EP RUNTIME 7.40 | SP020 | 000002
- EP RUNTIME 7.40 | SP021 | 000002
- EP RUNTIME 7.40 | SP022 | 000001
- EP RUNTIME 7.40 | SP023 | 000000
- FIORI LAUNCHPAD PORTAL 7.50 | SP014 | 000033
- FIORI LAUNCHPAD PORTAL 7.50 | SP015 | 000027
- FIORI LAUNCHPAD PORTAL 7.50 | SP016 | 000020
- FIORI LAUNCHPAD PORTAL 7.50 | SP017 | 000014
- FIORI LAUNCHPAD PORTAL 7.50 | SP018 | 000009
- FIORI LAUNCHPAD PORTAL 7.50 | SP019 | 000001
- FIORI LAUNCHPAD PORTAL 7.50 | SP020 | 000000
Affected component
- EP-PIN-NAV-FFP
Fiori Framework Page
CVSS
Score: 4.4
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2960329
