Application: SAP NetWeaver Integration Repository Versions Affected: SAP NetWeaver Integration Repository Vendor URL: http://www.sap.com Bugs: XSS Reported: 13.07.2012 Vendor response: 14.07.2012 Date of Public Advisory: 25.01.2014 Reference: SAP Note 1788080 CVSS: AV:N/AC:M/AU:N/C:N/I:P/A:N 4.3 Author: Dmitry Chastukhin (ERPScan)
DescriptionSAP NetWeaver has a linked XSS vulnerability in ESR application.
A cross-site scripting vulnerability can lead to injection of malicious scripts into a trusted web site. By exploiting this vulnerability, an internal or external attacker will be able to escalate their privileges. With the help of this access, it is possible to obtain sensitive technical and/or business-related information stored in the vulnerable SAP system.