SAP Netweaver 6.4 - 7.0 Cross Site Scripting

`  
Digital Security Research Group [DSecRG] Advisory #DSECRG-09-040  
  
  
Application: SAP Netweaver   
Versions Affected: Version 6.4 - 7.0   
Vendor URL: http://SAP.com  
Bugs: XSS  
Exploits: YES  
Reported: 26.05.2009  
Vendor response: 27.05.2009  
Date of Public Advisory: 13.07.2010  
CVE-number:   
Author: Alexandr Polyakov  
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)  
In addition by another security researcher at the same time.  
  
  
Description  
***********  
  
SAP Netweaver system has linked XSS security vulnerability in wsnavigator component  
  
  
  
Details  
*******  
  
http://dsecrg.com/pages/vul/show.php?id=140  
  
  
Example  
*******  
  
  
https://server/wsnavigator/jsps/explorer/help.jsp?title=Test">AAAAAAAA<script>alert('XSS')</script>  
  
  
References  
**********  
  
http://dsecrg.com/pages/vul/show.php?id=140  
https://service.sap.com/sap/support/notes/1169248  
  
  
  
Fix Information  
***************  
  
  
A solution for this issue is given by SAP in security note 1169248  
  
  
About  
*****  
  
Digital Security is one of the leading IT security companies in CEMEA,  
providing information security consulting, audit and penetration  
testing services, ERP and SAP security assessment, certification for ISO/IEC 27001:2005 and PCI DSS and PA DSS standards.  
Digital Security Research Group focuses on enterprise application (ERP) and database  
security problems with vulnerability reports, advisories and whitepapers  
posted regularly on our website.  
  
Contact: research [at] dsecrg [dot] com  
http://www.dsecrg.com   
  
  
  
  
  
  
  
  
  
Polyakov Alexandr. PCI QSA,PA-QSA  
Head of security audit department  
Head of Digital Security Research Group  
______________________  
DIGITAL SECURITY  
phone: +7 812 703 1547  
+7 812 430 9130  
e-mail: [email protected]   
www.dsec.ru  
www.dsecrg.com  
www.pcidss.ru  
  
  
-----------------------------------  
This message and any attachment are confidential and may be privileged or otherwise protected   
from disclosure. If you are not the intended recipient any use, distribution, copying or disclosure   
is strictly prohibited. If you have received this message in error, please notify the sender immediately   
either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence   
via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding   
statements by e-mail unless otherwise agreed.   
-----------------------------------   
`