Medium priority
SAP security note 2745917, "[CVE-2019-0316] Cross-Site Scripting (XSS) vulnerability in Integration Builder of SAP NetWeaver Process Integration", is a program error note released on 11.06.2019. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
The PI Integration Builder Web UI does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
- Non-permanently deface or modify displayed content from a website.
- Steal authentication information of the user, such as data relating to their current session.
- Impersonate the user and access all information with the same rights as the target user.
Solution
This issue has been fixed with the Support Packages and Patches referenced by this SAP Security Note.
Reason and prerequisites
To execute the attack, the victim must be tricked into clicking a malicious link. Furthermore, the victim needs certain privileges assigned to access the vulnerable page.
CVSS
Score 4.8 Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
References
Affected components
- SAP_XIESR: 7.20
- SAP_XITOOL: 7.10, 7.11, 7.30, 7.31, 7.40, 7.50
Full note on SAP: SAP Support Launchpad note 2745917
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].