Skip links

Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI, SAP security note 2945581

Description

UPDATE 8th December 2020: This note has been re-released with updated ‘Correction instruction’ information. We added the prerequisite note 2542223 in the correction instruction.

UPDATE 13th October 2020: This note has been re-released with updated  ‘Solution’ information. We have added the pre-implementation manual instruction in the solution section. The implementation requires a replacement of a MIME file, the existing file needs to be deleted manually before implementing the automatic instructions of the note.

SAP CRM WebClient UI does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are –

  • non-permanently deface or modify displayed content from a Web site
  • steal authentication information of the user, such as data relating to his or her current session
  • impersonate the user and access all information with the same rights as the target user 

Available fix and Supported packages

  • S4FND | 102 | 102
  • S4FND | 103 | 103
  • S4FND | 104 | 104
  • S4FND | 105 | 105
  • WEBCUIF | 731 | 731
  • WEBCUIF | 746 | 746
  • WEBCUIF | 747 | 747
  • WEBCUIF | 748 | 748
  • WEBCUIF | 800 | 800
  • WEBCUIF | 801 | 801
  • | SAPK-S4CLOUD_2011 |
  • S4FND 102 | SAPK-10207INS4FND |
  • S4FND 103 | SAPK-10305INS4FND |
  • S4FND 104 | SAPK-10403INS4FND |
  • S4FND 105 | SAPK-10501INS4FND |
  • WEBCUIF 731 | SAPK-73127INWEBCUIF |
  • WEBCUIF 747 | SAPK-74722INWEBCUIF |
  • WEBCUIF 748 | SAPK-74816INWEBCUIF |
  • WEBCUIF 800 | SAPK-80012INWEBCUIF |
  • WEBCUIF 801 | SAPK-80110INWEBCUIF |

Affected component

    CA-WUI-UI
    User Interface

CVSS

Score: 4.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2945581

TAGS

#&65279-XSS

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies