Skip links
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Cross-Site Scripting (XSS) vulnerability in CL_WDR_CLIENT_SSR_LS, SAP security note 2303032

Description

CL_WDR_CLIENT_SSR_LS does not sufficiently check the option to turn off external styleheets (CSS), resulting in Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are –

  • non-permanently deface or modify displayed content from a Web site
  • steal authentication information of the user, such as data relating to his or her current session
  • impersonate the user and access all information with the same rights as the target user 

Available fix and Supported packages

  • SAP_UI | 750 | 750
  • SAP_UI 750 | SAPK-75004INSAPUI |

Affected component

    BC-WD-ABA
    Web Dynpro ABAP

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2303032

TAGS

#&65279-XSS
#stored-XSS
#reflected-XSS
#CSS&65279

Explore More

SAP Security Patch Day – September 2025

SAP has released its September 2025 security patch package containing 26 security notes addressing critical vulnerabilities across enterprise SAP environments. This release

SAP Security Patch Day – August 2025

SAP has released its August 2025 security patch package containing 19 security notes addressing critical vulnerabilities across enterprise SAP environments. This release