Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1484089-3)
SAP Support Packages
(SAPKU40018, SAPKU50018, SAPKU52011, SAPKU60009, SAPKU70009, SAPKU70102)
Описание
The program code contains a possibility to define and execute code of the user#s choice which changes the system#s behavior. A valid and authenticated SAP CRM user is required. Depending on the code the user can inject and run their own code, the user may obtain additional information which should not be displayed, they may be able to modify data, delete data, modify the output of the system, or create new users with higher privileges or perform a denial of service attack.
The generated reports were used in CRM3.0A release but became obsolete since CRM4.0. The report generation is not required any more.
The generated reports were used in CRM3.0A release but became obsolete since CRM4.0. The report generation is not required any more.
Как исправить
(1) Unnecessary report generation is stopped.
(2) Authorization check is added to the program where generating report is still required. Only user with condition generation authorization (authority object /SAPCND/CO with activity 64 for generation) can execute this program to generate report CND_MAP_DYN_GET_LIN.
(2) Authorization check is added to the program where generating report is still required. Only user with condition generation authorization (authority object /SAPCND/CO with activity 64 for generation) can execute this program to generate report CND_MAP_DYN_GET_LIN.
Ссылки
