Skip links

SAP E-Sourcing Ethical Security Hack Cross-Site Framing, SAP security note 1262354

Description

SAP E-Sourcing customers have identified an issue where users of Microsoft® Internet Explorer may be susceptible to a cross-site framing attack due to an access validation error. Cross-site framing is when other sites encapsulate the SAP E-Sourcing application in another frame. This can result in users having their data stolen by phishing or spoofing attacks.

Available fix and Supported packages

  • ESOUSRMJAVASERVER | 4.2 | 4.2

Affected component

    SRM-ESO-UI
    User Interface for SAP Sourcing & CLM

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1262354

TAGS

#Friendly-Embedding-Domain-URL-Pattern
#JavaScript-regular-expressions