SAP BSP Applications Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in SAP BSP applications. This issue allows an unauthenticated user to inject malicious scripts through user-controlled URL parameters that are not properly sanitized. When a victim accesses a manipulated URL, the injected script executes in the victim's browser. This vulnerability has a low impact on confidentiality and integrity, with no effect on the application's availability.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where injected scripts are executed in the context of the victim's browser.

Remediation

Users are advised to consult the SAP Security Notes for guidance on addressing this vulnerability. SAP Security Notes can be accessed through the SAP for Me platform.