Skip links

BBPSC Cross-site scripting error, SAP security note 1058531

Description

You create a shopping cart and specify, for example, “<a href=”javascript:alert();”>Click me!</a>” as the description of an item. When you then open this shopping cart, for example, in “Check Status” (BBPSC04), the system displays a dialog box that contains the following text: “Click me!”.

Available fix and Supported packages

  • SRM_SERVER | 500 | 500
  • SRM_SERVER | 550 | 550
  • SRM_SERVER | 600 | 600
  • BBPCRM | 400 | 400
  • SRM_SERVER 550 | SAPKIBKT10 |
  • SRM_SERVER 600 | SAPKIBKU03 |
  • SRM_SERVER 500 | SAPKIBKS13 |
  • BBPCRM 400 | SAPKU40018 |

Affected component

    SRM-EBP-TEC-ITS
    ITS and Web files

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/1058531

TAGS

#BBPSC01
#BBPSC02
#BBPSC03
#XSS