SAP security note 2624762, "[CVE-2018-2431] Cross-Site Scripting (XSS) vulnerability in SAP CrystalReports". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP CrystalReports does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability are:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
The solution is to encode the parameter. It is fixed in the Support Packages and Patches listed in the "Support Packages & Patches" section below.
For Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559.
Reason and prerequisites
Parameter is not encoded on OpenDocument for CrystalReports Instances.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- CVE-2018-2431
Full note on SAP: SAP Support Launchpad note 2624762
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].