SAP Note 2464489
SAP security note 2464489, “Cross-Site Scripting (XSS) vulnerability in BIWorkspace”. Below are the symptom and the SAP recommended solution.
Description
Symptom
BIWorkspace does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Output encoding has been addressed in the patches listed in the “Support Packages & Patches” section below. This issue is fixed in the following patches.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2464489
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].