SAP security note 1629676, “Security fix for BSP application HCM_LEARNING”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Unauthorized modification of displayed content in the Learning Portal.
Solution
Please apply the attached correction instruction to resolve the issue.
Reason and prerequisites
Pages within the Learning Portal do not sufficiently encode OUTPUT parameters, resulting in a reflected cross-site scripting (XSS) issue. A reflected XSS attack can be used to non-permanently deface or modify displayed content from a website, steal another user’s authentication information, and potentially impersonate users, including administrators, compromising application security.
References
Affected components
- PE-LSO-LPO (LSOFE): Versions 200, 300, 600, 602, 603, 604, 605, 606, 616
Full note on SAP: SAP Support Launchpad note 1629676
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
