SAP security note 2254648, "Cross-Site Scripting (XSS) vulnerability in KM People Finder". Below are the symptom, CVSS score, SAP recommended solution, reason and prerequisites, and the affected software components.
Description
Symptom
KM People Finder does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability include:
- Non-permanently defacing or modifying displayed content from a website
- Stealing authentication information of the user, such as data relating to their current session
- Impersonating the user and accessing all information with the same rights as the target user
Solution
Implement the Support Packages and Patches referenced by this SAP Note.
Reason and prerequisites
Pages within KM People Finder do not sufficiently encode INPUT parameters, resulting in a reflected cross-site scripting issue. A reflected XSS attack can be used to non-permanently deface or modify displayed content from a website. Additionally, it can steal another user’s authentication information, potentially allowing an attacker to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
CVSS
Score 6.1 / 10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- KMC-CM versions 7.00 to 7.02
- KMC-CM version 7.30
- KMC-CM version 7.31
- KMC-CM version 7.40
- KMC-CM version 7.50
Full note on SAP: SAP Support Launchpad note 2254648
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
