SAP security note 2358285, "Cross-Site Scripting (XSS) vulnerability in Flash Island parts used in HCM Webdynpro applications", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
The Flash Island files used inside the HCM WD applications (e.g., talent management and performance management) do not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Non-permanently deface or modify displayed content from a website.
Steal authentication information of the user, such as data related to their current session.
Impersonate the user and access all information with the same rights as the target user.
Solution
Please apply the attached correction to your system or upgrade to the corresponding support package. Then, the vulnerable .swf files stored in the MIME repository are replaced by safe versions.
Reason and prerequisites
You are using an HCM application that includes Flash parts, for example, the talent review application in talent management or the calibration grind inside the performance management applications.
Full note on SAP: SAP Support Launchpad note 2358285
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].