Skip links

J2EE engine filter to check for XSS input, SAP security note 1262675

Description

You are using SAP CRM WebChannel or SAP E-Commerce and you want to add an additional possiblity to avoid Cross Site Scripting (XSS).

Available fix and Supported packages

  • SAP-CRMISA | 4.0 | 4.0
  • SAP-CRMISA | 4.0_640 | 4.0_640
  • SAP-CRMJAV | 5.0 | 5.0
  • SAP-CRMJAV | 5.2 | 5.2
  • SAP-CRMJAV | 6.0 | 6.0
  • SAP-CRMWEB | 5.0 | 5.0
  • SAP-CRMWEB | 5.1 | 5.1
  • SAP-CRMWEB | 5.2 | 5.2
  • SAP-CRMWEB | 6.0 | 6.0
  • SAP-SHRWEB | 5.0 | 5.0
  • SAP-SHRWEB | 5.2 | 5.2
  • SAP-SHRWEB | 6.0 | 6.0
  • SAP-SHRJAV | 5.0 | 5.0
  • SAP-SHRJAV | 5.2 | 5.2
  • SAP-SHRJAV | 6.0 | 6.0
  • SAP-CRMAPP | 5.0 | 5.0
  • SAP-CRMAPP | 5.2 | 5.2
  • SAP-CRMAPP | 6.0 | 6.0
  • SAP-SHRAPP | 5.0 | 5.0
  • SAP-SHRAPP | 5.2 | 5.2
  • SAP-SHRAPP | 6.0 | 6.0

Affected component

    CRM-ISA
    Internet Sales

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/1262675

TAGS

#isa
#Internet-Sales
#ECo
#E-Commerce
#E-Commerce
#WebChannel
#WebChannel
#CRM
#ERP
#r3
#r\3
#r/3
#ECC
#b2b
#Business-to-Business
#Business-to-Business
#b2c
#Business-to-Customer
#Business-to-Customer
#isauseradm
#isauseradmin
#isa-useradm
#isa-useradmin
#useradmin
#useradmin
#shopadmin
#shop-admin
#XSS
#X-SS

How to detect over 4100 vulnerabilities in SAP Systems?

More to explorer

Initiating SAP Penetration Testing

►   Pentest, short for penetration testing, refers to a set of processes that simulate an attacker’s actions to identify security vulnerabilities. Companies

SAP Security Patch Day RedRays

May 2024 SAP Security Patch Day

Vulnerability: Multiple vulnerabilities in SAP CX Commerce SAP Component: CEC-SCC-PLA-PL CVE ID: CVE-2019-17495 CVSS Score: 9.8 CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Category: Program error