Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1442580-3)
SAP Support Packages
(SAPKB64026, SAPKB70022, SAPKB70107, SAPKB70204, SAPKB71010, SAPKB71105, SAPKB72003)
Описание
Some pages within the RWB Alert-Configuration do not sufficiently encode input parameters, resulting in a reflected cross site scripting issue and cross domain redirection vulnerabilities.
Reflected cross site scripting can be used to steal another user's authentication information such as data relating to their current session, or can be used to non-permanently deface a web site. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user.
In case of an administrator being impersonated, a full compromise of the application's security may occur.
The following releases and SP-levels are affected:
SAP BASIS 6.40 until SP26
SAP BASIS 7.00 until SP22
SAP BASIS 7.01 until SP07
SAP BASIS 7.02 until SP04
SAP BASIS 7.03 until SP01
SAP BASIS 7.10 until SP10
SAP BASIS 7.11 until SP05
SAP BASIS 7.20 until SP03
Reflected cross site scripting can be used to steal another user's authentication information such as data relating to their current session, or can be used to non-permanently deface a web site. An attacker who gains access to this data may use this to impersonate the user and access all information with the same rights as the target user.
In case of an administrator being impersonated, a full compromise of the application's security may occur.
The following releases and SP-levels are affected:
SAP BASIS 6.40 until SP26
SAP BASIS 7.00 until SP22
SAP BASIS 7.01 until SP07
SAP BASIS 7.02 until SP04
SAP BASIS 7.03 until SP01
SAP BASIS 7.10 until SP10
SAP BASIS 7.11 until SP05
SAP BASIS 7.20 until SP03
Как исправить
The fix is delivered with the assigned Support Packages of the corresponding releases and also included as of release SAP_BASIS 7.30.
Please upgrade your system to the corresponding Support Package assigned to this note or apply the attached correction instructions.
Please upgrade your system to the corresponding Support Package assigned to this note or apply the attached correction instructions.
Ссылки
