Advisory
On 10.09.2024 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within JAVA.
SAP Note 3505503 addresses "[CVE-2024-45280] Cross-Site Scripting (XSS) Vulnerability in SAP NetWeaver AS Java (Logon Application)" to prevent cross-site scripting (xss) with a medium risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Cross-site scripting (XSS) is the name of a class of security vulnerabilities that can occur in web-based
applications. XSS combines
all vulnerabilities that allow an attacker to inject HTML Markup and/or JavaScript into the front end of the
affected web application.
XSS attacks can occur whenever the application dynamically creates its HTML/JavaScript/CSS content, which is passed
to the
user's web browser, and attacker-controlled values are used in this process. If these values are included in the
generated code without proper validation and encoding, the attacker is able to include arbitrary
coding snippets into the application's front end. The code is then rendered by the victim's web browser and
interpreted in the victim's current authentication context.
Risk specification
Due to insufficient encoding of user-controlled inputs, SAP NetWeaver AS Java allows malicious scripts to be executed in the login application. This has a limited impact on confidentiality and integrity of the application. There is no impact on availability.Solution
Please apply the correction according to the Validity and Support Packages & Patches sections of this security note. Note: To avoid incompatibilities on the system, check SAP Note 1974464 - Information on SCA Dependency Analysis for Java download objects1974464 - Information on SCA Dependency Analysis for Java download objects. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "Update in progress".
Affected System
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
- 8.8 [CVE-2024-22126] Cross Site Scripting vulnerability in NetWeaver AS Java (User Admin Application)
- 8.7 [CVE-2023-42472] Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)
- 8.3 [CVE-2021-33702] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- 8.3 [CVE-2021-33703] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- 8.2 [CVE-2023-33991] Stored Cross-Site Scripting vulnerability in SAP UI5 (Variant Management)