SAP security note 2409262, "Cross-Site Scripting (XSS) vulnerability in BI Promotion Management Application". Below are the symptom and SAP recommended solution.
Description
Symptom
The Promotion Management application does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability can allow attackers to:
- Deface or modify displayed content on the website.
- Steal authentication information, such as session data.
- Impersonate users and access information with their privileges.
Solution
The issue is fixed by removing obsolete files from the open source library. Apply the relevant support packages and patches as listed below.
For more information on the maintenance schedule and strategy for the Business Intelligence Platform, see SAP Note 2144559.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2409262
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].