Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1427695-1)
Описание
Prior to SAP NW CE 7.20 it was not possible to restrict the file types to be added by participants in business processes. Since BPM as a platform is not intended for use with open user goups (i.e. anonymous users) the risk is rated low. However, the possibility of internal security violations was still existing.
Как исправить
Upgrade to SAP NW BPM 7.20 or subsequent.
Restriction of attachment file types is confgured via the "context.attachments.extensions" application property of the "tc~bpem~base~ear" application. If present, the value of the property must be comma-separated list of the allowed attachment extensions, e.g. "txt, jpg, zip, doc". In this case only files with the configured extensions will be allowed as attachments to BPM tasks and processes. If no value is set, there will be no file type check and all file extensions will be allowed.
Use the following procedure to configure restriction of attachment file types:
1. Log on to SAP NetWeaver Administrator and navigate to Configuration Management -> Infrastructure -> Java System Properties. The Java System Properties screen opens.
2. On the Details area choose the Applications tab.
3. Choose "tc~bpem~base~ear" application.
4. On the Properties area, choose the "context.attachments.extensions" property and modify its value as follows: Choose Modify, enter the comma-separated list of allowed attachments extensions and then choose Set. To confirm choose Save.
Restriction of attachment file types is confgured via the "context.attachments.extensions" application property of the "tc~bpem~base~ear" application. If present, the value of the property must be comma-separated list of the allowed attachment extensions, e.g. "txt, jpg, zip, doc". In this case only files with the configured extensions will be allowed as attachments to BPM tasks and processes. If no value is set, there will be no file type check and all file extensions will be allowed.
Use the following procedure to configure restriction of attachment file types:
1. Log on to SAP NetWeaver Administrator and navigate to Configuration Management -> Infrastructure -> Java System Properties. The Java System Properties screen opens.
2. On the Details area choose the Applications tab.
3. Choose "tc~bpem~base~ear" application.
4. On the Properties area, choose the "context.attachments.extensions" property and modify its value as follows: Choose Modify, enter the comma-separated list of allowed attachments extensions and then choose Set. To confirm choose Save.
Ссылки
