SAP security note 2574897, "Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a DOM-based Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability include:
Non-permanently defacing or modifying displayed content from a website
Stealing authentication information of the user, such as data relating to their current session
Impersonating the user and accessing all information with the same rights as the target user
Unauthorized execution of commands
Solution
Input encoding and validation have been added. Please implement the solution below or install the equivalent Support Package.
Reason and prerequisites
CRM WebClient UI does not encode or validate untrusted input. The attacker needs to trick an already authenticated user into visiting a prepared website to launch the attack.
CVSS
Score 6.1 Vector: CVSS:/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- SAPSCORE: Versions 112
- S4FND: Versions 102
- WEBCUIF: Versions 700, 701, 730, 731, 746, 747, 748, 800, 801
Full note on SAP: SAP Support Launchpad note 2574897
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].