Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1482118-8)
SAP Support Packages
(SAPK-70118INVCBWTECH, SAPKW35027, SAPKW70025, SAPKW70108, SAPKW70205)
Описание
Since adequate source code for outputting via a Web page in BPS planning has not been implemented, reflected cross-site scripting is triggered. Using this, the contents of a Web page can be manipulated when a manipulated link is called, for example.
An attacker can exploit reflected cross-site scripting to steal the logon information from the current session of a victim. Using this information, the attacker can then impersonate the victim to the server and run the application with the same rights as the user that was attacked.
If the target of the attack is a user that has administrative rights, all of the data in the application may be compromised as a result.
An attacker can exploit reflected cross-site scripting to steal the logon information from the current session of a victim. Using this information, the attacker can then impersonate the victim to the server and run the application with the same rights as the user that was attacked.
If the target of the attack is a user that has administrative rights, all of the data in the application may be compromised as a result.
Как исправить
Ссылки
