SAP security note 2419524, “Reflected Cross-Site Scripting (XSS) in Web Intelligence BI Launchpad”, was released on June 13, 2017. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Web Intelligence BI Launchpad does not sufficiently encode user-controlled inputs in workflows involving date formatting, resulting in a Cross-Site Scripting (XSS) vulnerability.
Impacts of XSS Vulnerability:
- Non-permanently deface or modify displayed content from a website
- Steal authentication information of the user, such as data relating to their current session
- Impersonate the user and access all information with the same rights as the target user
Solution
User entries validation has been improved for the impacted pages. This issue is fixed in the patches listed in the “Support Packages & Patches” section below.
For the Business Intelligence Platform maintenance schedule and strategy, see the Knowledge Base Article 2144559 in the References section.
CVSS
Score 6.1 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Affected components
- ENTERPRISE 4.0
- ENTERPRISE 410
- ENTERPRISE 420
Full note on SAP: SAP Support Launchpad note 2419524
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].