Medium priority
SAP security note 2424671, "Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Generic Object Services", is a program error note released on 09.05.2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The Generic Object Services Display Note functionality does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Impacts of XSS vulnerability include:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Implement the correction using the Note Assistant or import the relevant Support Package.
CVSS
Score 5.4 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
Affected components
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 711
- SAP_BASIS 730 to 731
- SAP_BASIS 740 to 751
Full note on SAP: SAP Support Launchpad note 2424671
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].