Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

BSP Test Applications in Production Systems, SAP security note 887164

Description

Quite often one sees XSS attacks described that uses the aspect of writing HTML and JavaScript into form fields, which is then echo’d back to the browser. The problem here is that the application did not invest the additional development effort to validate all input, and in addition to HTML encode all output before sending it back to the browser.

There are a number of BSP test applications that fall into this category. With the next SPs, these applications will be rechecked, and the necessary HTML encoding will be added where needed.

Available fix and Supported packages

  • SAP_BASIS | 610 | 640
  • SAP_BASIS | 700 | 700
  • SAP_BASIS | 710 | 710

Affected component

    BC-BSP
    Business Server Pages

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/887164

TAGS

#

More to explorer