Skip links

Cross-site scripting error in BBP_POC, SAP security note 1267878

Description

You are using transaction BBP_POC (Create Purchase Order). On the initial screen, you choose the “Create” button. In the “Purchase Order Name” field, you then enter “…”…” (that is, a double quotation mark), for example. After you trigger any action in this transaction, the text disappears behind the double quotation mark. This may be used for cross-site scripting.

Available fix and Supported packages

  • SRM_SERVER | 500 | 500
  • SRM_SERVER | 550 | 550
  • SRM_SERVER 500 | SAPKIBKS15 |
  • SRM_SERVER 550 | SAPKIBKT14 |

Affected component

    SRM-EBP-TEC-ITS
    ITS and Web files

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1267878

TAGS

#XSS