Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1469368-4)
SAP Support Packages
(SAPK-70408INBICONT, SAPK-70502INBICONT)
Описание
You have activated the business function ISR_RETAIL_RMA in ERP. In the RMA workbench in the BW system, authorization checks that regulate the access to functions are missing. Without these checks, a logged-on user can simply call these functions and this leads to the possibility of an unwanted change of the system behavior.
Как исправить
Import Support Package 02 for BI_CONT 7.05 or Support Package 08 for BI_CONT 7.04, or implement the attached correction instructions.
In addition, you must define a secure RFC connection for synchronous method calls in ALE Customizing.
Implementation Guide (IMG): SAP NetWeaver -> Application Server -> IDoc Interface / Application Link Enabling (ALE) -> Communication -> Determine RFC Destinations for Method Calls. For the logical system corresponding to the ERP target system, you must define a standard destination for BAPIs here that forces another authentication of the RMA Workbench user to the ERP system.
In addition, you must define a secure RFC connection for synchronous method calls in ALE Customizing.
Implementation Guide (IMG): SAP NetWeaver -> Application Server -> IDoc Interface / Application Link Enabling (ALE) -> Communication -> Determine RFC Destinations for Method Calls. For the logical system corresponding to the ERP target system, you must define a standard destination for BAPIs here that forces another authentication of the RMA Workbench user to the ERP system.
Ссылки
