[DSECRG-09-068] SAP NetWaver SLD - Multiple XSS SAP Netweaver System has multiple linked XSS security vulnerabilities in its System Landscape Directory component. Digital Security Research Group [DSecRG] Advisory DSecRG-09-068 Application: SAP NetWeaver SLD Versions Affected: 6.4 - 7.02 Vendor URL: http://SAP.com Bugs: XSS Exploits: YES Reported: 14.12.2009 Vendor response: 15.12.2009 last response: 06.05.2010 Date of Public Advisory: 13.07.2010 CVE-number: Author: Alexander Polyakov Alexey Troshichev Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com) Description *********** SAP Netweaver System has multiple linked XSS security vulnerabilities in its System Landscape Directory component Details ******* 1. XSS in TestSDICServlet Vulnerable script: testsdic Vulnerable parameter: action An attacker can send a link to the administrator and get the cookie. 2 XSS in SLD Help Vulnerable script: paramhelp.jsp Vulnerable parameter: helpstring An attacker can send a link to the administrator and get the cookie. References ********** http://dsecrg.com/pages/vul/show.php?id=168 https://service.sap.com/sap/support/notes/1416047 Fix Information *************** Solution for this issue is given in security note 1416047 About ***** Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, ERP and SAP security assessment, certification for ISO/IEC 27001:2005 and PCI DSS and PA DSS standards. Digital Security Research Group focuses on enterprise application (ERP) and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website. Contact: research [at] dsecrg [dot] com http://www.dsecrg.com