Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1493101-1)
SAP Support Packages
(SAPK-60208INEAAPPL, SAPK-60307INEAAPPL, SAPK-60408INEAAPPL, SAPK-60502INEAAPPL, SAPKGPAB20, SAPKGPAC24, SAPKGPAD19)
Описание
The program code contains a possibility to define code of the user's choice which if executed may changes the system's behavior. A valid and authenticated user is required.
Depending on the code the user can inject own code, the user may obtain additional information which should not be displayed, he may be able to modify data, delete data, modify the output of the system, create new users with higher privileges or perform a denial of service attack.
Depending on the code the user can inject own code, the user may obtain additional information which should not be displayed, he may be able to modify data, delete data, modify the output of the system, create new users with higher privileges or perform a denial of service attack.
Как исправить
The coding in question will be removed through the listed support packages.
As an immediate measure you can apply the attached advanced correction.
As an immediate measure you can apply the attached advanced correction.
Ссылки
