SAP Security Note
High priority
SAP security note 1441953, "Logon data can be discovered: XSS", is a program error note released on 11.05.2010. Below are the symptom and SAP recommended solution.
Description
Symptom
Certain Web Dynpro ABAP pages do not adequately encode input parameters, resulting in a reflexive XSS vulnerability. This allows attackers to:
Steal logon data of users.
Deface or alter the contents of a page.
Imitate different users within the system, gaining access to their information and authorizations.
Compromise the security of the entire application if administrative user data is targeted.
Solution
Implement the correction instructions provided in this security note or import the relevant Support Package to mitigate the vulnerability.
Full note on SAP: SAP Support Launchpad note 1441953
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].