SAP security note 2374661, “Cross-Site Scripting (XSS) vulnerability in Unified Rendering / SAP GUI for HTML”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Unified Rendering does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerabilities include:
- Non-permanently defacing or modifying displayed content from a website
- Stealing authentication information of the user, such as data relating to their current session
- Impersonating the user and accessing all information with the same rights as the target user
Solution
Please install a new SAP Kernel patch as mentioned below.
Reason and prerequisites
This issue occurs only when using SAP GUI for HTML in combination with SAP Screen Personas 3.0. If you do not use SAP Screen Personas, this SAP Note is not relevant.
References
Affected components
- KRNL64NUC: 7.22, 7.42, 7.49, 7.22EXT
- KRNL64UC: 7.22, 7.42, 7.49, 7.22EXT
- AJAX-RUNTIME: 7.20, 7.30, 7.31, 7.40, 7.50
- KERNEL: 7.22, 7.42, 7.45, 7.48, 7.49, 7.50, 7.51
- FRAMEWORK: 7.10-7.11, 7.20
Full note on SAP: SAP Support Launchpad note 2374661
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].