SAP security note 2444673, “Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Development Infrastructure Cockpit”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP NetWeaver Development Infrastructure Cockpit does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Track filter are now properly encoded to prevent a successful XSS attack.
Reason and prerequisites
UI code is missing encoding of filter content.
CVSS
Score 5.4 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Affected components
- DI_NTY 7.50
Full note on SAP: SAP Support Launchpad note 2444673
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
