SAP security note 2595262, "Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The SAP CRM WebClient UI does not adequately encode user inputs, leading to an XSS vulnerability. This can result in:
- Content Manipulation: Defacing or modifying website content temporarily.
- Session Hijacking: Stealing authentication tokens or session information.
- User Impersonation: Gaining unauthorized access with the same privileges as the targeted user.
- Unauthorized Command Execution: Executing unintended commands within the application.
Solution
The security note mandates the implementation of input encoding and validation mechanisms within the SAP CRM WebClient UI to mitigate the XSS vulnerability. Customers are advised to apply the provided solution or install the equivalent Support Package to ensure protection against potential exploits.
Affected components
- SAPSCORE 112
- S4FND 102
- WEBCUIF 748
- WEBCUIF 800
- WEBCUIF 801
Full note on SAP: SAP Support Launchpad note 2595262
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].