Medium priority
SAP security note 2879132, “[CVE-2020-6226] Cross-Site Scripting (XSS) Vulnerabilities in SAP Business Objects Business Intelligence Platform”, was released on April 14, 2020. Below are the symptom, SAP recommended solution and references.
Description
Symptom
SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) does not sufficiently encode user-controlled inputs, resulting in Stored Cross-Site Scripting (XSS) vulnerabilities on different parameters. These vulnerabilities can be exploited to:
- Non-permanently deface or modify displayed content from a website.
- Steal authentication information of the user, such as data relating to their current session.
- Impersonate the user and access all information with the same rights as the target user.
Solution
The URL parameters are now properly encoded to prevent successful XSS attacks. This issue is fixed in the following Support Package Patches for SBOP BI Platform Servers 4.2.
CVSS
Score 5.4 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
References
- CVE-2020-6226
- CVE-2020-6231
- BI 4.x Maintenance Strategy & Schedule (SAP Note 2144559)
Full note on SAP: SAP Support Launchpad note 2879132
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].