Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1470094-2)
Описание
In the report H99_B2AFILE, there are no authorization checks that control the access to functions. Without these checks, a user who is logged on can simply call these functions and may be able to change the system behavior. You do not want this to happen.
It is possible for an attacker to load application server files on the PC, and to overwrite application server files with other files.
It is possible for an attacker to load application server files on the PC, and to overwrite application server files with other files.
Как исправить
The correction is delivered by HR Support Package (see attached Note 1448318).
See SAP Note 1232082 for the connection between the HR Support Package and the technical name specified in the note under "Support Packages".
Alternatively, you can implement the correction instructions.
After importing the Support Package or implementing the note, users who are to execute the report require the following authorization in their authorization profiles:
P_B2A (Authorization object)
B2A_ACTIO (Field)
R - Reorganize notifications (value)
As far as we know, there are no HR customers in Releases 3.1I to 4.6B. The report might still be available in integrated systems (for example, FI & HCM). In this case, delete the report H99_B2AFILE.
See SAP Note 1232082 for the connection between the HR Support Package and the technical name specified in the note under "Support Packages".
Alternatively, you can implement the correction instructions.
After importing the Support Package or implementing the note, users who are to execute the report require the following authorization in their authorization profiles:
P_B2A (Authorization object)
B2A_ACTIO (Field)
R - Reorganize notifications (value)
As far as we know, there are no HR customers in Releases 3.1I to 4.6B. The report might still be available in integrated systems (for example, FI & HCM). In this case, delete the report H99_B2AFILE.
Ссылки
