Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1491435-1)
SAP Support Packages
(SAPK-50019INSCMBASIS, SAPK-51018INSCMBASIS, SAPK-70009INSCMBASIS, SAPK-70102INSCMBASIS, SAPKY50019, SAPKY51015, SAPKY70009, SAPKY70102)
Описание
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement including strings that can be altered by a malicious user. The manipulated SQL statement can then be used to retrieve additional information from the database or to potentially modify it.
Как исправить
In order to install the security correction, implement this note or install corresponding support package.
Prerequisite note is 1490783.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCM_BASIS Supply Chain Ma...|
| Release 500 Until SAPK-50018INSCMBASIS |
| Release 510 Until SAPK-51017INSCMBASIS |
| Release 701 Until SAPK-70101INSCMBASIS |
| Release 700 Until SAPK-70008INSCMBASIS |
------------------------------------------------------------------------
Run transaction SE91.
Enter the following in the Message class field: /SCMB/ABAS
Add the following message to the message class:
Number: 522
Text: No authorization to delete alerts of the selected alert type(s)
Save the new text.
Prerequisite note is 1490783.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCM_BASIS Supply Chain Ma...|
| Release 500 Until SAPK-50018INSCMBASIS |
| Release 510 Until SAPK-51017INSCMBASIS |
| Release 701 Until SAPK-70101INSCMBASIS |
| Release 700 Until SAPK-70008INSCMBASIS |
------------------------------------------------------------------------
Run transaction SE91.
Enter the following in the Message class field: /SCMB/ABAS
Add the following message to the message class:
Number: 522
Text: No authorization to delete alerts of the selected alert type(s)
Save the new text.
Ссылки
