SAP security note 2972661, "[CVE-2020-6367] Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver Composite Application Framework". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
There is a Reflected cross site scripting vulnerability in SAP NetWeaver Composite Application Framework. An unauthenticated attacker can trick an unsuspecting authenticated user to click on a malicious link. The end user’s browser has no way to know that the script should not be trusted, and will execute the script, resulting in sensitive information being disclosed or modified.
Solution
The URL parameters are now properly encoded to prevent a successful XSS attack. Implement the Support Packages and Patches referenced by this SAP Note.
CVSS
Score 8.2 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N
References
Affected components
- SAP CAF 7.20
- SAP CAF 7.30
- SAP CAF 7.31
- SAP CAF 7.40
- SAP CAF 7.50
Full note on SAP: SAP Support Launchpad note 2972661
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].