Skip links
Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI, SAP security note 2945581

Description

UPDATE 8th December 2020: This note has been re-released with updated ‘Correction instruction’ information. We added the prerequisite note 2542223 in the correction instruction.

UPDATE 13th October 2020: This note has been re-released with updated  ‘Solution’ information. We have added the pre-implementation manual instruction in the solution section. The implementation requires a replacement of a MIME file, the existing file needs to be deleted manually before implementing the automatic instructions of the note.

SAP CRM WebClient UI does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.

Some well-known impacts of XSS vulnerability are –

  • non-permanently deface or modify displayed content from a Web site
  • steal authentication information of the user, such as data relating to his or her current session
  • impersonate the user and access all information with the same rights as the target user 

Available fix and Supported packages

  • S4FND | 102 | 102
  • S4FND | 103 | 103
  • S4FND | 104 | 104
  • S4FND | 105 | 105
  • WEBCUIF | 731 | 731
  • WEBCUIF | 746 | 746
  • WEBCUIF | 747 | 747
  • WEBCUIF | 748 | 748
  • WEBCUIF | 800 | 800
  • WEBCUIF | 801 | 801
  • | SAPK-S4CLOUD_2011 |
  • S4FND 102 | SAPK-10207INS4FND |
  • S4FND 103 | SAPK-10305INS4FND |
  • S4FND 104 | SAPK-10403INS4FND |
  • S4FND 105 | SAPK-10501INS4FND |
  • WEBCUIF 731 | SAPK-73127INWEBCUIF |
  • WEBCUIF 747 | SAPK-74722INWEBCUIF |
  • WEBCUIF 748 | SAPK-74816INWEBCUIF |
  • WEBCUIF 800 | SAPK-80012INWEBCUIF |
  • WEBCUIF 801 | SAPK-80110INWEBCUIF |

Affected component

    CA-WUI-UI
    User Interface

CVSS

Score: 4.7
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

PoC

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2945581

TAGS

#&65279-XSS

More to explorer

Special offer for SAP Security Udemy course!

$ 9.99

Join “SAP Security Core Concepts and Security Administration” which is part of the Blackhat course series.