SAP Note 2392509
SAP security note 2392509, "Cross-Site Scripting (XSS) vulnerability in Enterprise Portal styleservice", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
Styleservice does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Output encoding methods are now used to protect against the attack.
CVSS
Score 5.4 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2392509
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
