Description
This SAP security note addresses several vulnerabilities identified in ABAP Online Community Application of SAP NetWeaver and S/4HANA. The vulnerability details along with their CVE relevant information can be found below.
Reflected Cross Site Scripting
Under certain conditions, ABAP Online Community does not sufficiently encode user controlled inputs, resulting in Reflected Cross-Site Scripting (XSS) vulnerability.
- CVSS Score: 6.1; CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Stored Cross-Site Scripting (XSS)
Under certain conditions ABAP Online Community, allows an authenticated attacker to store a malicious payload which results in Stored Cross Site Scripting vulnerability.
- CVE-2020-6185
- CVSS Score: 5.4; CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Some well-known impacts of Cross-Site Scripting are –
- non-permanently deface or modify displayed content from a Web site
- steal authentication information of the user, such as data relating to his or her current session
- impersonate the user and access all information with the same rights as the target user
Available fix and Supported packages
- SAP_BASIS | 740 | 740
- SAP_BASIS | 750 | 754
- SAP_BASIS 751 | SAPK-75110INSAPBASIS |
- SAP_BASIS 752 | SAPK-75206INSAPBASIS |
- SAP_BASIS 753 | SAPK-75304INSAPBASIS |
- SAP_BASIS 740 | SAPKB74024 |
- SAP_BASIS 754 | SAPK-75402INSAPBASIS |
- SAP_BASIS 750 | SAPK-75018INSAPBASIS |
Affected component
- BC-MID-AC
ABAP Channels
CVSS
Score: 6.1
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/2880869
