SAP security note 2406783, "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Central Technical Configuration". Below are the symptom and SAP recommended solution.
Description
Symptom
Central Technical Configuration does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Impacts of XSS Vulnerability:
- Non-permanently deface or modify displayed content on a website.
- Steal authentication information of the user, such as data relating to their current session.
- Impersonate the user and access all information with the same rights as the target user.
Solution
Additional security checks have been added in the code when handling HTTP requests to ensure malicious requests are not executed.
To be protected against this vulnerability, apply the associated patch for your release.
CVSS
Score 6.3 Vector: AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2406783
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
