Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1510064-8)
SAP Support Packages
(SAPK-110B5INEAHRGXX, SAPK-20096INEAHRGXX, SAPK-50081INEAHRGXX, SAPK-60064INEAHRGXX, SAPK-60243INEAHRGXX, SAPK-60338INEAHRGXX, SAPK-60430INEAHRGXX, SAPK-60505INEAHRGXX)
Описание
PA-EC and PA-CP execute certain functions through referencing specific URLs. When an attacker tricks an authenticated user#s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
Как исправить
The correction will be delivered with Support Package. The relationship between the Support Package and the technical name given under "Support Packages" is described in SAP note 1232082.
As alternative you can implement the correction instructions:
1. Refer to note 1520324 for additional information and instructions. The corrections from note 1520324 are a prerequisite for implementation of this note.
2. Implement the correction instructions of this note. This will also create the report RH_EAHR_BSP_XSRF_PARAM (RHHCP_BSP_XSRF_PARAM in Release 110) in your system.
3. Execute the report in the development system and specify when requested a corresponding transport request number. The report will fill the database table BSPTEMPXSRFSTORE with corresponding table entries for the BSP applications adapted by this note.
As alternative you can implement the correction instructions:
1. Refer to note 1520324 for additional information and instructions. The corrections from note 1520324 are a prerequisite for implementation of this note.
2. Implement the correction instructions of this note. This will also create the report RH_EAHR_BSP_XSRF_PARAM (RHHCP_BSP_XSRF_PARAM in Release 110) in your system.
3. Execute the report in the development system and specify when requested a corresponding transport request number. The report will fill the database table BSPTEMPXSRFSTORE with corresponding table entries for the BSP applications adapted by this note.
Ссылки
