The vulnerability found targets the SAP NetWeaver portal. It is
when clicking on a specially crafted URL which can be sent to the
user by email.
This vulnerability can be used to steal the user's session cookie or
redirect him to a phishing website which shows the (faked) login
screen and gets his logon credentials as soon as he tries to log in
on the faked site.
All tested versions that are vulnerable
SAP NetWeaver/Web DynPro
[for detailed Information, see SAP Notification 1235253]
A specially crafted URL in SAP NetWeaver allows an attacker to
launch a Cross-Site Scripting attack. The resulting page contains
only the unfiltered value of the vulnerable parameter. It is possible
to create an URL which causes the resulting page to contain malicious
The code only gets executed in Microsoft Internet Explorer (tested
with version 7.0.5730 only). In Firefox (tested with version 3.0
only) it did not get executed as the content-type header of the
server response is interpreted more strictly (text/plain).
SAP Information Policy:
The information is available to registered SAP clients only (SAP
Apply the latest SAP security patches for Netweaver. For more detailed
patch information, see SAP notification number 1235253.
Vendor Status: Patch released
Vendor Notified: July 21st 2008
Vendor Response: July 28th 2008
Patch available: October 2008
Advisory Release: January 27th 2009