Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Cross-Site Scripting (XSS) vulnerability in SAP Netweaver Portal, SAP security note 2491480

SAP Note 2491480
SAP Security Note
Medium priority

SAP security note 2491480, “Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Portal”, is a program error note released on September 12, 2017. Below are the symptom and the SAP recommended solution.

ComponentBasis Components > Web Dynpro > WebDynpro Java
CategoryProgram error
PriorityMedium priority
TypeSAP Security Note
Version3
StatusReleased for Customer
Released onSeptember 12, 2017
LanguageEnglish

Description

Symptom

WebDynpro Java does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.

Impacts:

  • Defacing or modifying displayed content on a website.
  • Stealing user authentication information, such as session data.
  • Impersonating the user to access information with the same privileges.

Solution

Ensure that URL parameters are properly sanitized before being processed by the framework. Applying this security note will address and resolve the vulnerability.

Reason and prerequisites

The WebDynpro Java application insufficiently encodes URL parameters, leading to a stored Cross-Site Scripting (XSS) issue.

CVSS

Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Full note on SAP: SAP Support Launchpad note 2491480

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#WebDynpro Java #Cross-Site Scripting #SAP NetWeaver Portal #Web Dynpro

Explore More