SAP Note 2550538
SAP security note 2550538, "[CVE-2018-2397] Cross-Site Scripting (XSS) vulnerability in SAP BI Central Management Console", is a note. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP BI Central Management Console (CMC) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
This issue is fixed in the patches listed below. Please apply the relevant support package patches to mitigate the vulnerability.
CVSS
Score 5.4 Vector: AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Full note on SAP: SAP Support Launchpad note 2550538
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].