Cross-Site Scripting (XSS) vulnerability in SAP Enterprise Portal Real Time Collaboration, SAP security note 2341302

SAP Note 2341302

SAP security note 2341302, "Cross-Site Scripting (XSS) vulnerability in SAP Enterprise Portal Real Time Collaboration". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

RTC Application Sharing in SAP NetWeaver does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Impacts of XSS Vulnerability:

Non-permanently deface or modify displayed content from a website.
Steal authentication information of the user, such as data relating to their current session.
Impersonate the user and access all information with the same rights as the target user.

Solution

Applied proper encoding targeting input validation to mitigate the XSS vulnerability.

CVSS

Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Referenced by

Affected components

RTC 7.00 to 7.02
RTC 7.30 to 7.31
RTC 7.40

Full note on SAP: SAP Support Launchpad note 2341302

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Cross-Site Scripting
#XSS
#SAP Enterprise Portal
#Real Time Collaboration