Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1508412-2)
SAP Support Packages
(SAPKNA7022)
Описание
The program code contains a possibility to define and execute code of the user's choice which changes the system's behavior. A valid and authenticated user is not required. Depending on the code the user can inject and run own code, the user may obtain additional information which should not be displayed, he may be able to modify data, delete data, modify the output of the system, create new users with higher privileges or perform a denial of service attack.
Как исправить
Apply the attached correction instructions.
Note: Please make sure that the Manual preimplementation steps are also performed.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_AP SAP Application... |
| Release 700 Until SAPKNA7021 |
------------------------------------------------------------------------
Create the following message in the message class /SAPCND/GENERATOR using transaction se91.
370 Invalid reportname: &1
Note: Please make sure that the Manual preimplementation steps are also performed.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_AP SAP Application... |
| Release 700 Until SAPKNA7021 |
------------------------------------------------------------------------
Create the following message in the message class /SAPCND/GENERATOR using transaction se91.
370 Invalid reportname: &1
Ссылки
