Skip links

Security HTML Encoding missing over the inputField tooltip, SAP security note 1275278

Description

When a user enters a text that contains html code and there is Javascript code in that text, under certain conditions this Javascript code can pass through the http filter that checks for dangerous content. It then can be executed the next time it is rendered.

Available fix and Supported packages

  • CRMUIF | 520 | 520
  • CRMUIF | 600 | 600
  • WEBCUIF | 700 | 700
  • WEBCUIF | 730 | 730
  • CRMUIF 520 | SAPK-52007INCRMUIF |
  • CRMUIF 600 | SAPK-60006INCRMUIF |
  • WEBCUIF 700 | SAPK-70002INWEBCUIF |
  • WEBCUIF 730 | 730 |

Affected component

    CRM-FRW-UI-TAG
    Please use CA-WUI-UI-TAG instead

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1275278

TAGS

#XSS
#Cross-Site-Scripting
#JavaScript
#malicious-code