Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1507735-4)
SAP Support Packages
(SAPK-60019INISM, SAPK-60209INISM, SAPK-60308INISM, SAPK-60409INISM, SAPK-60503INISM, SAPKIPPM26, SAPKIPPM27, SAPKIPPN20, SAPKIPPN21)
Описание
IS-Media executes certain functions by referencing specific URLs. When a malicious user tricks an authenticated user#s browser into making a request containing a certain URL and specific parameters, the functions in IS-Media are executed with the rights of the authenticated user. The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.
Как исправить
Import the relevant Support Package.
If you want to implement an advance correction up to and including IS-M 604, perform the following steps:
1. Prerequisites
Are you using BSP applications?
Implement Note 1520324. Pay particular attention to the manual step described there.
Are you using ITS applications?
Implement Note 1481392. Pay particular attention to the manual step described there.
2. Use the Note Assistant (transaction SNOTE) to implement the corrections contained in this note.
3. Manual post-implementation steps:
Are you using BSP applications?
To correct these BSP applications, execute the report RJ_BSP_XSRF_PARAM_ISM_606.
Are you using ITS applications (IACs)?
To correct these ITS applications, execute the report RJ_ITS_XSRF_PARAM_ISM_606.
If you want to implement an advance correction up to and including IS-M 604, perform the following steps:
1. Prerequisites
Are you using BSP applications?
Implement Note 1520324. Pay particular attention to the manual step described there.
Are you using ITS applications?
Implement Note 1481392. Pay particular attention to the manual step described there.
2. Use the Note Assistant (transaction SNOTE) to implement the corrections contained in this note.
3. Manual post-implementation steps:
Are you using BSP applications?
To correct these BSP applications, execute the report RJ_BSP_XSRF_PARAM_ISM_606.
Are you using ITS applications (IACs)?
To correct these ITS applications, execute the report RJ_ITS_XSRF_PARAM_ISM_606.
Ссылки
