SAP SRM Live Auction Cockpit Java Applet Vulnerability Allowing Cross-Site Scripting

A vulnerability exists in the Live Auction Cockpit of SAP Supplier Relationship Management (SRM) due to the use of a deprecated Java applet component in certain SRM packages. This flaw enables an unauthenticated attacker to execute malicious scripts in the browser of the affected user. The vulnerability has a low impact on confidentiality and integrity within the context of the user's browser, and does not affect the application's availability.

Impact

Exploitation of this vulnerability allows for cross-site scripting (XSS) attacks, where an attacker can inject malicious scripts that are executed in the context of the victim's browser.

Remediation

Users are advised to review and implement the SAP Security Note related to this vulnerability, available through the SAP Security Patch Day program.