Skip links

Cross-Site Scripting (XSS) vulnerability in CL_WDR_CLIENT_SSR_LS, SAP security note 2303032

Description

CL_WDR_CLIENT_SSR_LS does not sufficiently check the option to turn off external styleheets (CSS), resulting in Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are –

  • non-permanently deface or modify displayed content from a Web site
  • steal authentication information of the user, such as data relating to his or her current session
  • impersonate the user and access all information with the same rights as the target user 

Available fix and Supported packages

  • SAP_UI | 750 | 750
  • SAP_UI 750 | SAPK-75004INSAPUI |

Affected component

    BC-WD-ABA
    Web Dynpro ABAP

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2303032

TAGS

#&65279-XSS
#stored-XSS
#reflected-XSS
#CSS&65279

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies