On 13.04.2021 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within Java.
SAP Note 2963592 addresses "[CVE-2021-27601] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (Applications based on HTMLB for Java)" to prevent cross-site scripting (xss) with a medium risk for exploitation.
A workaround does not exist, according to SAP Security Advisory team. It is advisable to implement the correction as part of maintenance, the team suggests.
Cross-site scripting (XSS) is the name of a class of security vulnerabilities that can occur in web-based
applications. XSS combines
affected web application.
Risk specificationAn attacker with basic privileges is able to store a malicious file on the SAP NetWeaver Application Server Java. When a victim tries to open this particular file it results in a Cross-Site Scripting vulnerability and the attacker will be able to read and modify data but does not have control over kind and degree.
The HTMLB for Java framework encodes uploaded files correctly at the server-side now.
SAP Netweaver Application Server Java is part of the SAP NetWeaver Application Platform. It provides the complete infrastructure for deploying and running Java applications.
- The AS Java Home: SAP Netweaver Application Server Java wiki
- A dedicated SAP NetWeaver 7.40 Application Server for Java Security Guide exists.
The advisory is valid for
- EP-BASIS 7.10-7.11 2
- EP-BASIS 7.30 2
- EP-BASIS 7.31 2
- EP-BASIS 7.40 2
- EP-BASIS 7.50 2
- FRAMEWORK 7.10-7.11 6
- FRAMEWORK-EXT 7.30 3
- FRAMEWORK-EXT 7.31 3
- FRAMEWORK-EXT 7.40 3
- FRAMEWORK-EXT 7.50 3
- 6.4 [CVE-2021-27600 ] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Execution (System Rules)
- 6.1 [CVE-2020-6305] Cross-Site Scripting (XSS) vulnerability in Rest Adapter of SAP Process Integration
- 5.4 [CVE-2020-6303] Improper input validation in SAP Disclosure Management
- 5.4 [CVE-2019-0395] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Fiori BI Launchpad)
- 5.4 [CVE-2021-21447] Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)