Security Note, XML Forms XSS restricton in URL parameters, SAP security note 1141070

SAP security note 1141070, "Security Note, XML Forms: XSS restricton in URL parameters", released on May 21, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Web servers that accept input parameters via HTTP requests and dynamically generate HTML pages based on these inputs are potentially vulnerable to Cross Site Scripting (XSS) attacks. Specifically, XML Forms are affected as some input parameters in the HTTP requests are vulnerable to XSS.

Solution

A. The issue is fixed in the following deliveries:

• KMC SAP NetWeaver 7.0 SP14 Patch 1 for KMC CONTENT MANAGEMENT 7.0
• KMC SAP NetWeaver 7.0 SP15 Patch 1 for KMC CONTENT MANAGEMENT 7.0
• KMC SAP NetWeaver 7.0 SP16

For schedule details and updates, visit the SP Stack Schedule.

B. Possible workaround before applying the above deliveries: No workaround is available.

Reason and prerequisites

CODING ERROR – Some input parameters in HTTP requests do not properly sanitize user input, allowing XSS attacks.

Affected components

• Enterprise Portal > Enterprise Portal – Knowledge Management and Collaboration > Content Management (EP-KM-CM)
• KMC-CM: 7.00 to 7.00
• EP-CM: 6.0_640 to 6.0_640