Skip links
RedRays
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

multiple XSS vulnerabilies in Design Time Repository, SAP security note 1432114

Description

The DTR (Design Time Repository) can be abused by a malicious user allowing them to obtain authentication information from other legitimate users

Available fix and Supported packages

  • DI_DTR | 7.00 | 7.02
  • DI_DTR | 7.11 | 7.11
  • DI_DTR | 7.20 | 7.20
  • SAP_DEVINF | 6.40 | 6.40
  • DI DESIGN TIME REPOSITORY 6.40 | SP024 | 000001
  • DI DESIGN TIME REPOSITORY 6.40 | SP025 | 000001
  • DI DESIGN TIME REPOSITORY 6.40 | SP026 | 000001
  • DI DESIGN TIME REPOSITORY 7.00 | SP018 | 000001
  • DI DESIGN TIME REPOSITORY 7.00 | SP019 | 000001
  • DI DESIGN TIME REPOSITORY 7.00 | SP020 | 000001
  • DI DESIGN TIME REPOSITORY 7.00 | SP021 | 000001
  • DI DESIGN TIME REPOSITORY 7.00 | SP022 | 000001
  • DI DESIGN TIME REPOSITORY 7.00 | SP023 | 000000
  • DI DESIGN TIME REPOSITORY 7.01 | SP003 | 000003
  • DI DESIGN TIME REPOSITORY 7.01 | SP004 | 000003
  • DI DESIGN TIME REPOSITORY 7.01 | SP005 | 000001
  • DI DESIGN TIME REPOSITORY 7.01 | SP006 | 000001
  • DI DESIGN TIME REPOSITORY 7.01 | SP007 | 000001
  • DI DESIGN TIME REPOSITORY 7.01 | SP008 | 000000
  • DI DESIGN TIME REPOSITORY 7.02 | SP003 | 000000
  • DI DESIGN TIME REPOSITORY 7.02 | SP004 | 000000
  • DI DESIGN TIME REPOSITORY 7.11 | SP002 | 000002
  • DI DESIGN TIME REPOSITORY 7.11 | SP003 | 000001
  • DI DESIGN TIME REPOSITORY 7.11 | SP004 | 000001

Affected component

    BC-CTS-DTR-SRV
    Design Time Repository Server

CVSS

Score: 0

Exploit

Exploit is not available.
For detailed information please contact the mail [email protected].

URL

https://launchpad.support.sap.com/#/notes/1432114

TAGS

#NWDI
#DTR
#Design-Time-Repository
#XSS

More to explorer