SAP Note 2939419
SAP security note 2939419, “[CVE-2020-6370] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver (DI Design Time Repository)”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP NetWeaver Design Time Repository (DTR) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Impacts:
- Defacement: Non-permanently deface or modify displayed content from a website.
- Session Hijacking: Steal authentication information of the user, such as data relating to their current session.
- Impersonation: Impersonate the user and access all information with the same rights as the target user.
Solution
- URL Encoding: The URL parameters are now properly encoded to prevent a successful XSS attack.
- Apply Patches: Implement the Support Packages and Patches referenced by this SAP Note.
CVSS
Score 4.8 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Affected components
- DI_DTR: Versions 7.11, 7.30, 7.31, 7.40, 7.50
Full note on SAP: SAP Support Launchpad note 2939419
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].