SAP security note 2320703, “Update 1 to Security Note 1512776.” Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Enterprise Services Repository (ESR) does not sufficiently encode user-controlled inputs, resulting in a Cross-Site Scripting (XSS) vulnerability.
Some well-known impacts of XSS vulnerability include:
- Non-permanently defacing or modifying displayed content from a website
- Stealing authentication information of the user, such as data relating to their current session
- Impersonating the user and accessing all information with the same rights as the target user
Solution
This is fixed with the Support Packages and Patches referenced by this SAP Security Note. The URL parameters are now properly encoded to prevent a successful XSS attack.
Reason and prerequisites
This is an update to SAP Note 1512776, which fixes the problem in version 7.02. The XSS countermeasures are ported to all releases where the correction was missing.
CVSS
Score 6.1/10 Vector: AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
This note refers to
Affected components
- SAP_XIESR: 7.10 to 7.11
- SAP_XITOOL: 7.00 to 7.01
- SAP_XITOOL: 7.10 to 7.11
Full note on SAP: SAP Support Launchpad note 2320703
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].