SAP security note 2996479, “[CVE-2020-26835] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP NetWeaver (ABAP Server) and ABAP Platform do not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
The URL parameters are now properly encoded to prevent a successful XSS attack.
Please implement the Support Packages and Patches referenced by this SAP Note.
Reason and prerequisites
ABAP Keyword Documentation of SAP NetWeaver (ABAP Server) and ABAP Platform enables a malicious user to inject JavaScript into the information presented, potentially altering the information to be incorrect.
CVSS
Score 5.3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected components
- SAP_BASIS from version 740 to 740
- SAP_BASIS from version 750 to 755
Full note on SAP: SAP Support Launchpad note 2996479
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
