SAP security note 2547977, “[CVE-2018-2365] Cross-Site Scripting (XSS) vulnerability in SAP Netweaver Portal”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
WebDynpro Java does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Impacts of XSS Vulnerability:
- Deface Content: Non-permanently deface or modify displayed content from a website.
- Steal Information: Steal authentication information of the user, such as data relating to the current session.
- Impersonate Users: Impersonate the user and access all information with the same rights as the target user.
Solution
URL parameters are sanitized properly before being consumed by the framework.
Reason and prerequisites
WebDynpro Java application insufficiently encodes URL parameters, resulting in a stored Cross Site Scripting issue.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Affected components
- WebDynpro Java 7.30
- WebDynpro Java 7.31
- WebDynpro Java 7.40
- WebDynpro Java 7.50
Full note on SAP: SAP Support Launchpad note 2547977
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
