SAP security note 2201295, "Cross-Site Scripting (XSS) vulnerability in UR Control", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
UR Control does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
The encoding has been added, preventing a successful XSS attack.
To fix this issue, please see the description for your basis framework:
A) Web Dynpro ABAP: Update the Unified Rendering part of Web Dynpro ABAP according to the following notes, depending on the SAP_UI / SAP_BASIS release of SAP NetWeaver:
- 7.50: 2207387 – Unified Rendering fur SAP_UI 750 or fixed with SAP UI 7.50 SP04
- 7.40: 2154957 – Unified Rendering for SAP_UI 740 or fixed with SAP UI 7.40 SP16
- 7.31: 2156710 – Unified Rendering for SAP_BASIS 731 or fixed with SAP BASIS 7.31 SP18
- 7.30: 2454726 – Unified Rendering for SAP_BASIS 730 or fixed with SAP BASIS 7.30 SP15
- 7.02: 2097342 – Unified Rendering for SAP_BASIS 702 or fixed with SAP BASIS 7.02 SP18
- 7.01: 2154821 – Unified Rendering for SAP_BASIS 701 or fixed with SAP BASIS 7.01 SP18
- 7.11: 2159126 – Unified Rendering for SAP_BASIS 711 or fixed with SAP BASIS 7.11 SP16
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2201295
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].