Skip links

Further cross-site scripting errors, SAP security note 1077910

Description

The symptom is similar to the symptom in Note 1058531:
You create a shopping cart and specify “<a href=”javascript:alert();”>Click me!</a>” as the description of an item, for example.

When you then open this shopping cart, for example, in “Check Status” (BBPSC04), and display the change documents, the system displays a dialog box that contains the following text: “Click me!”.

This problem may also occur with “Confirm Goods / Services” (BBPCF02) if you display the details of an item.

Available fix and Supported packages

  • SRM_SERVER | 500 | 500
  • SRM_SERVER | 550 | 550
  • SRM_SERVER 500 | SAPKIBKS15 |
  • SRM_SERVER 550 | SAPKIBKT14 |

Affected component

    SRM-EBP-TEC-ITS
    ITS and Web files

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1077910

TAGS

#BBPSC04
#BBPCF02
#BBPCF01
#XSS
#cross-site-scripting