Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1492145-5)
SAP Support Packages
(SAPKH31IB9, SAPKH40B89, SAPKH45B67, SAPKH46B62, SAPKH46C62, SAPKH47035, SAPKH50024, SAPKH60019, SAPKH60209, SAPKH60308, SAPKH60409, SAPKH60502)
Описание
The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is [required / not required]. [List all other pre-requisites for example special authorizations required to execute the injected code] Depending on the code, the user can:
inject and run their own code,
obtain additional information that should not be displayed,
modify data, delete data,
modify the output of the system,
create new users with higher privileges,
perform a denial of service attack.
The coding belongs to an obsolete PAI module, that is no more used in any dynpro screen. The potentially security relevant coding is nevertheless removed from the report.
inject and run their own code,
obtain additional information that should not be displayed,
modify data, delete data,
modify the output of the system,
create new users with higher privileges,
perform a denial of service attack.
The coding belongs to an obsolete PAI module, that is no more used in any dynpro screen. The potentially security relevant coding is nevertheless removed from the report.
Как исправить
Implement the correction instructions.
Ссылки
