Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1432682-2)
Описание
The session ID has been used for associating several entries in different log files for understanding certain error scenarios in support. If an attacker reads these logs in the lifetime of a session, he could highjack such a session.
You're using a Businsess Connector up to version 4.7 CoreFix 9 or 4.8 up to CoreFix 1.
You're using a Businsess Connector up to version 4.7 CoreFix 9 or 4.8 up to CoreFix 1.
Как исправить
An internal session ID has been introduced still allowing the desired supportability without having the need to log the session ID sent by the client.
Business Connector 4.7: Please apply CoreFix 10.
Business Connector 4.8: Please apply at least CoreFix 2.
NB: if this note is applied to a Reverse Invoke configuration,
please install the Core Fixes mentioned here on all involved Business Connector servers. Further ensure that both, the internal and the external, Business Connector servers are of the same release (i.e. a combination of 4.7 and 4.8 will no longer work).
Business Connector 4.7: Please apply CoreFix 10.
Business Connector 4.8: Please apply at least CoreFix 2.
NB: if this note is applied to a Reverse Invoke configuration,
please install the Core Fixes mentioned here on all involved Business Connector servers. Further ensure that both, the internal and the external, Business Connector servers are of the same release (i.e. a combination of 4.7 and 4.8 will no longer work).
Ссылки
