Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1450128-3)
SAP Support Packages
(SAPK-470A6INSAPHRRXX, SAPK-50072INSAPHRRXX, SAPK-60055INSAPHRRXX, SAPK-60421INSAPHRRXX, SAPKE46CG1)
Описание
The program code contains a possibility to define and execute code of the user's choice which changes the system's behavior. A valid and authenticated user and authorization for transaction SA38 or SE38 is required.
Although the vulnerability is caused by code belonging to SAP_HR the injection is not restricted to this component as the injected code can affect any other component of the system.
Although the vulnerability is caused by code belonging to SAP_HR the injection is not restricted to this component as the injected code can affect any other component of the system.
Как исправить
Apply the attached correction instructions or implement the HR support pacakges in which the corrections have been included.
Please take into account the following special shipment conditions for relases Enterprise R/3 4.7 and higher:
The objects to be corrected are part of software component SAP_HRXX. This software component contains country independent objects of SAP_HR which according to note 1167891 are shipped twice a year in so called Synchronization HRSPs. Given the priority of the issue, the corrections have been included in the next available HRSP for each release although they are not Synchronization HRSPs.
These next available HRSPs are:
Enterprise R/3 4.7 SAPK-470A6INSAPHRRXX
ECC 5.00 SAPK-50072INSAPHRRXX
ECC 6.00 SAPK-60055INSAPHRRXX
ECC 6.04 SAPK-60421INSAPHRRXX
The consequence of this is that customers that have chosen the
CLC mode to implement HRSPs (check note 1167891) will only receive the corrections in the next Synchronization HRSPs and not as part of the CLC deliveries of the next available HRSPs as the CLC delivery does only contain country specific objects.
Customers that have not chosen the CLC mode to implement HRSPs will
receive the correction with the HRSPS mentioned above.
No special testing is necessary as obsolete and not used ABAP code is
deleted by this correction.
Please take into account the following special shipment conditions for relases Enterprise R/3 4.7 and higher:
The objects to be corrected are part of software component SAP_HRXX. This software component contains country independent objects of SAP_HR which according to note 1167891 are shipped twice a year in so called Synchronization HRSPs. Given the priority of the issue, the corrections have been included in the next available HRSP for each release although they are not Synchronization HRSPs.
These next available HRSPs are:
Enterprise R/3 4.7 SAPK-470A6INSAPHRRXX
ECC 5.00 SAPK-50072INSAPHRRXX
ECC 6.00 SAPK-60055INSAPHRRXX
ECC 6.04 SAPK-60421INSAPHRRXX
The consequence of this is that customers that have chosen the
CLC mode to implement HRSPs (check note 1167891) will only receive the corrections in the next Synchronization HRSPs and not as part of the CLC deliveries of the next available HRSPs as the CLC delivery does only contain country specific objects.
Customers that have not chosen the CLC mode to implement HRSPs will
receive the correction with the HRSPS mentioned above.
No special testing is necessary as obsolete and not used ABAP code is
deleted by this correction.
Ссылки
