SAP security note 2849967, “[CVE-2020-6276] Cross-Site Scripting (XSS) vulnerability in SAP Business Objects Business Intelligence Platform(Bipodata)”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Business Objects Business Intelligence Platform (Bipodata) does not adequately encode user-controlled inputs, resulting in an XSS vulnerability. This flaw can be exploited to:
- Deface or modify displayed content on a website temporarily
- Steal user authentication information, including session data
- Impersonate users and access information with their privileges
Solution
SAP has addressed this vulnerability by encoding parameters at the necessary locations. The issue is resolved in the patches listed below under the “Support Package Patches” section.
Reason and prerequisites
Certain parameters within the platform were not properly encoded, allowing the injection of malicious scripts.
CVSS
Score 6.1 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected components
- SAP Business Intelligence Platform Servers 4.2 and 4.3
Full note on SAP: SAP Support Launchpad note 2849967
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].