Skip links
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Cross-Site Scripting (XSS) vulnerability in ITS / SAP GUI for HTML, SAP security note 2318760

Description

ITS / SAP GUI for HTML does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are:

  • non-permanently deface or modify displayed content from a Web site
  • steal authentication information of the user, such as data relating to his or her current session
  • impersonate the user and access all information with the same rights as the target user 

Available fix and Supported packages

  • SAP_BASIS | 700 | 702
  • SAP_BASIS | 710 | 711
  • SAP_BASIS | 730 | 730
  • SAP_BASIS | 731 | 731
  • SAP_BASIS | 740 | 740
  • SAP_BASIS | 750 | 750
  • SAP_BASIS | 764 | 764
  • SAP_BASIS 700 | SAPKB70034 |
  • SAP_BASIS 701 | SAPKB70119 |
  • SAP_BASIS 702 | SAPKB70219 |
  • SAP_BASIS 730 | SAPKB73016 |
  • SAP_BASIS 731 | SAPKB73119 |
  • SAP_BASIS 740 | SAPKB74016 |
  • SAP_BASIS 750 | SAPK-75005INSAPBASIS |

Affected component

    BC-FES-ITS
    SAP Internet Transaction Server

CVSS

Score: 0

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2318760

TAGS

#&65279-XSS
#stored-XSS
#reflected-XSS
#CSS&65279
#SAP-GUI-for-HTML
#ITS
#webgui

Explore More

SAP Security Patch Day – September 2025

SAP has released its September 2025 security patch package containing 26 security notes addressing critical vulnerabilities across enterprise SAP environments. This release

SAP Security Patch Day – August 2025

SAP has released its August 2025 security patch package containing 19 security notes addressing critical vulnerabilities across enterprise SAP environments. This release

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.