Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1472498-4)
SAP Support Packages
(SAPKH60307, SAPKH60408, SAPKH60502, SAPKU70102)
Описание
The program code contains a possibility to define and execute code of the user's choice which changes the system's behavior. A valid and authenticated user is required. Depending on the code the user can inject and run their own code, the user may obtain additional information which should not be displayed, they may be able to modify data, delete data, modify the output of the system, or create new users with higher privileges or perform a denial of service attack.
A valid user assigned with change activity to the following authorizations will be able to run this program
CPE_SETTIN
CPE_COVER
CPE_DOCDAT
CPE_DOCDEF
CPE_PRICEQ
A valid user assigned with change activity to the following authorizations will be able to run this program
CPE_SETTIN
CPE_COVER
CPE_DOCDAT
CPE_DOCDEF
CPE_PRICEQ
Как исправить
A white list will be introduced here, after apply the correction only the table from this white list can be updated by this program.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 603 Until SAPKH60306 |
| Release 604 Until SAPKH60407 |
| Release 605 Until SAPKH60501 |
------------------------------------------------------------------------
Call the transaction SE91
Edit the message class CPE_ERP
Add the message with message number 041, text 'You are not authorized to update the table &1', save
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 701 Until SAPKU70101 |
------------------------------------------------------------------------
(1) Call the transaction SE91
(2) Edit the message class CPE_CRM
(3) Add the message with message number 141, text 'You are not authorized to update the table &1', save
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_APPL SAP Application |
| Release 603 Until SAPKH60306 |
| Release 604 Until SAPKH60407 |
| Release 605 Until SAPKH60501 |
------------------------------------------------------------------------
Call the transaction SE91
Edit the message class CPE_ERP
Add the message with message number 041, text 'You are not authorized to update the table &1', save
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 701 Until SAPKU70101 |
------------------------------------------------------------------------
(1) Call the transaction SE91
(2) Edit the message class CPE_CRM
(3) Add the message with message number 141, text 'You are not authorized to update the table &1', save
Ссылки
