Description
UPDATE 8th December 2020: This note has been re-released with updated ‘Correction instruction’ information. We added the prerequisite note 2542223 in the correction instruction.
UPDATE 13th October 2020: This note has been re-released with updated ‘Solution’ information. We have added the pre-implementation manual instruction in the solution section. The implementation requires a replacement of a MIME file, the existing file needs to be deleted manually before implementing the automatic instructions of the note.
SAP CRM WebClient UI does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are –
- non-permanently deface or modify displayed content from a Web site
- steal authentication information of the user, such as data relating to his or her current session
- impersonate the user and access all information with the same rights as the target user
Available fix and Supported packages
- S4FND | 102 | 102
- S4FND | 103 | 103
- S4FND | 104 | 104
- S4FND | 105 | 105
- WEBCUIF | 731 | 731
- WEBCUIF | 746 | 746
- WEBCUIF | 747 | 747
- WEBCUIF | 748 | 748
- WEBCUIF | 800 | 800
- WEBCUIF | 801 | 801
- | SAPK-S4CLOUD_2011 |
- S4FND 102 | SAPK-10207INS4FND |
- S4FND 103 | SAPK-10305INS4FND |
- S4FND 104 | SAPK-10403INS4FND |
- S4FND 105 | SAPK-10501INS4FND |
- WEBCUIF 731 | SAPK-73127INWEBCUIF |
- WEBCUIF 747 | SAPK-74722INWEBCUIF |
- WEBCUIF 748 | SAPK-74816INWEBCUIF |
- WEBCUIF 800 | SAPK-80012INWEBCUIF |
- WEBCUIF 801 | SAPK-80110INWEBCUIF |
Affected component
- CA-WUI-UI
User Interface
CVSS
Score: 4.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2945581
