SAP security note 2684760, "[CVE-2018-2470] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP Business Server Pages". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Update 18th October 2018: Correction Instructions now extended to lower SPs.
SAP Business Server Pages applications do not sufficiently encode user-controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.
Solution
“X-Content-Type-Options” is added to the HTTP header of BSP and is set to “nosniff” for MIME objects.
Reason and prerequisites
The header “X-Content-Type-Options” is not set. It can lead to MIME Sniffing Attacks.
CVSS
Score 6.1/10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- SAP_BASIS 700 to 702
- SAP_BASIS 730
- SAP_BASIS 731
- SAP_BASIS 740
- SAP_BASIS 750 to 753
Full note on SAP: SAP Support Launchpad note 2684760
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].