SAP Security Note
Medium priority
SAP security note 999076, "Security note: Entry/output validation Learning Portal", is a program error note released on 08.10.2009. Below are the symptom and SAP recommended solution.
Description
Symptom
On some pages of the Learning Portal, Cross Site Scripting (XSS) security breaches may occur. These security breaches are corrected with this note.
Solution
Import the Support Package specified in this note for SAP Learning Solution.
Additional steps as of LSO300: after importing the Support Package, ensure that all pages to be displayed in the Learning Portal not delivered by SAP are implemented in the lspage_alias_c database table. If not, the relevant page cannot be called, and the system will display the error.htm standard error page.
Reason and prerequisites
There are unsecured input parameters in the BSP pages specified.
CVSS
Score 0
References
This note refers to
Full note on SAP: SAP Support Launchpad note 999076
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].