Skip links

Further cross-site scripting errors, SAP security note 1077910

Description

The symptom is similar to the symptom in Note 1058531:
You create a shopping cart and specify “<a href=”javascript:alert();”>Click me!</a>” as the description of an item, for example.

When you then open this shopping cart, for example, in “Check Status” (BBPSC04), and display the change documents, the system displays a dialog box that contains the following text: “Click me!”.

This problem may also occur with “Confirm Goods / Services” (BBPCF02) if you display the details of an item.

Available fix and Supported packages

  • SRM_SERVER | 500 | 500
  • SRM_SERVER | 550 | 550
  • SRM_SERVER 500 | SAPKIBKS15 |
  • SRM_SERVER 550 | SAPKIBKT14 |

Affected component

    SRM-EBP-TEC-ITS
    ITS and Web files

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1077910

TAGS

#BBPSC04
#BBPCF02
#BBPCF01
#XSS
#cross-site-scripting

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies

SAP Security Patch Day RedRays

May 2024 SAP Security Patch Day

Vulnerability: Multiple vulnerabilities in SAP CX Commerce SAP Component: CEC-SCC-PLA-PL CVE ID: CVE-2019-17495 CVSS Score: 9.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Category: Program error