SAP security note 2588763, "[CVE-2019-0244] Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI", is a program error note released on 07.01.2019. Below are the symptom and SAP recommended solution.
Description
Symptom
SAP CRM WebClient UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Non-permanently deface or modify displayed content from a website
Steal authentication information of the user, such as data relating to their current session
Impersonate the user and access information with the same rights as the target user
Unauthorized execution of commands
Solution
Input encoding and validation have been added.
Reason and prerequisites
CRM WebClient UI does not encode or validate untrusted input. An attacker needs to trick an already authenticated user into visiting a prepared website to launch the attack.
CVSS
Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
Referenced by
Full note on SAP: SAP Support Launchpad note 2588763
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
