Description
When you insert control sequences (for example, TAB <=> 0x09), XSS attacks may occur that ignore the existing filter mechanisms.
In Web Dynpro for ABAP, this can be used, for example, using the standard element “sap-ep-themeroot”, to include external JS code.
Available fix and Supported packages
- SAP_BASIS | 700 | 701
- SAP_BASIS | 710 | 711
Affected component
- BC-SEC
Security – Read KBA 2985997 for subcomponents
CVSS
Score: 0
Exploit
Exploit is not available.
For detailed information please contact the mail [email protected].
URL
https://launchpad.support.sap.com/#/notes/1154828
