Advisory
On 22.09.2020 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP CRM UI.
SAP Note 2945581 addresses "Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI" to prevent Cross-Site Scripting (XSS) with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Cross-site scripting (XSS) is the name of a class of security vulnerabilities that can occur in web-based
applications. XSS combines
all vulnerabilities that allow an attacker to inject HTML Markup and/or JavaScript into the front end of the
affected web application.
XSS attacks can occur whenever the application dynamically creates its HTML/JavaScript/CSS content, which is passed
to the
user's web browser, and attacker-controlled values are used in this process. If these values are included in the
generated code without proper validation and encoding, the attacker is able to include arbitrary
coding snippets into the application's front end. The code is then rendered by the victim's web browser and
interpreted in the victim's current authentication context.
Risk specification
This note has been re-released with updated 'Correction instruction' information. - This note has been re-released with updated 'Solution’ information. - SAP CRM WebClient UI does not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability.Solution
jQuery has been upgraded to prevent the vulnerabilities.
The advisory is valid for
- S4FND 102 12
- S4FND 103 12
- S4FND 104 12
- S4FND 105 9
- WEBCUIF 731 11
- WEBCUIF 746 11
- WEBCUIF 747 11
- WEBCUIF 748 12
- WEBCUIF 800 12
- WEBCUIF 801 12
- 9.0 [CVE-2020-6284] Cross-Site Scripting (XSS) in SAP NetWeaver (Knowledge Management)
- 8.2 [CVE-2020-6367] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Composite Application Framework
- 8.1 [CVE-2022-26101] Cross-Site Scripting (XSS) vulnerability in SAP Fiori launchpad
- 7.6 [CVE-2023-39437] Cross-Site Scripting (XSS) vulnerability in SAP Business One
- 6.5 [CVE-2023-0025] Cross Site Scripting in SAP Solution Manager (BSP Application)