SAP Security Note
Medium priority
SAP security note 2764733, "XSS Vulnerability in SAP BusinessObjects BI Workspace", is a program error note released on 09.07.2019. Below are the symptom and the SAP recommended solution.
Description
Symptom
BIWorkspace does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability. Some well-known impacts of XSS vulnerability include:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
Added input validation for input fields. This issue is fixed in the patches listed in the "Support Packages & Patches" section below. The "Support Packages & Patches" section will be populated with the relevant patch levels once they are released.
For Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559 in the References section.
Reason and prerequisites
Environment: SAP BusinessObjects Business Intelligence Platform 4.x.
CVSS
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Full note on SAP: SAP Support Launchpad note 2764733
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].