Cross-Site Scripting (XSS) vulnerability in Web Dynpro Java, SAP security note 2469860

SAP Note 2469860

SAP security note 2469860, “Cross-Site Scripting (XSS) vulnerability in Web Dynpro Java”. Below are the symptom and the SAP recommended solution.

Description

Symptom

Unified Rendering in Web Dynpro Java does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability allows attackers to:

Non-permanently deface or modify displayed content from a website
Steal user authentication information, such as session data
Impersonate users and access information with their privileges

The XSS vulnerability can lead to:

Content defacement or modification
Theft of user session information
User impersonation with the same access rights

Solution

The issue is resolved by applying the rendering-related Web Dynpro for Java patch that provides proper output encoding. Please install this patch or a newer cumulative patch. The patches are available on the SAP Service Marketplace.

CVSS

Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References

Full note on SAP: SAP Support Launchpad note 2469860

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Web Dynpro Java #Cross-Site Scripting #Unified Rendering #XSS