Skip links

CVE-2020-6323 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal (Fiori Framework Page), SAP security note 2960329

Description

SAP NetWeaver Enterprise Portal (Fiori Framework Page) does not sufficiently encode user controlled inputs and allows an attacker on a valid session to create an XSS that will be both reflected immediately and also be persisted and returned in further access to the system, resulting in Cross Site Scripting.

Since the specific scenario is protected by an XSRF token, the attacker should know the token to be able to target the victim.

Some well-known impacts of XSS vulnerability are –

  • Non-permanently deface or modify displayed content from a Web site
  • Steal authentication information of the user, such as data relating to his or her current session
  • Impersonate the user and access all information with the same rights as the target user 

Available fix and Supported packages

  • EP-FLP | 7.50 | 7.50
  • EP-RUNTIME | 7.31 | 7.31
  • EP-RUNTIME | 7.40 | 7.40
  • EP RUNTIME 7.31 | SP019 | 000021
  • EP RUNTIME 7.31 | SP021 | 000005
  • EP RUNTIME 7.31 | SP022 | 000004
  • EP RUNTIME 7.31 | SP025 | 000002
  • EP RUNTIME 7.31 | SP026 | 000002
  • EP RUNTIME 7.31 | SP027 | 000001
  • EP RUNTIME 7.31 | SP028 | 000000
  • EP RUNTIME 7.40 | SP014 | 000020
  • EP RUNTIME 7.40 | SP016 | 000005
  • EP RUNTIME 7.40 | SP017 | 000004
  • EP RUNTIME 7.40 | SP020 | 000002
  • EP RUNTIME 7.40 | SP021 | 000002
  • EP RUNTIME 7.40 | SP022 | 000001
  • EP RUNTIME 7.40 | SP023 | 000000
  • FIORI LAUNCHPAD PORTAL 7.50 | SP014 | 000033
  • FIORI LAUNCHPAD PORTAL 7.50 | SP015 | 000027
  • FIORI LAUNCHPAD PORTAL 7.50 | SP016 | 000020
  • FIORI LAUNCHPAD PORTAL 7.50 | SP017 | 000014
  • FIORI LAUNCHPAD PORTAL 7.50 | SP018 | 000009
  • FIORI LAUNCHPAD PORTAL 7.50 | SP019 | 000001
  • FIORI LAUNCHPAD PORTAL 7.50 | SP020 | 000000

Affected component

    EP-PIN-NAV-FFP
    Fiori Framework Page

CVSS

Score: 4.4
CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected]

URL

https://launchpad.support.sap.com/#/notes/2960329

TAGS

#&65279-XSS
#Stored-XSS
#Reflected-XSS
#CSS&65279
#&160-CVE-2020-6323