SAP Note 2443586
SAP security note 2443586, "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Authentication and SSO". Below are the symptom and SAP recommended solution.
Description
Symptom
Authentication with SAML 2.0 functionality does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
- The URL parameters are now properly encoded to prevent a successful XSS attack.
- Implement the Support Packages and Patches referenced by this SAP Note.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2443586
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].