Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1511107-4)
SAP Support Packages
(SAPKH31IB9, SAPKH40B89, SAPKH45B67, SAPKH46B62, SAPKH46C62, SAPKH47035, SAPKH50024, SAPKH60019, SAPKH60209, SAPKH60308, SAPKH60409, SAPKH60503)
Описание
The program code allows source code that can be determined freely to be added and executed, which enables an attacker to control the system response. Valid logon information is required for this.
In addition, the attacker must be authorized to execute function modules in transaction SE37 (authorization object S_DEVELOP with activity 03 or 16 depending on the release in accordance with Notes 587410, 1525695 and 1357258).
Depending on the source code added, the attacker can obtain unauthorized access to data and change or delete it; the attacker can also change system output or create new users, and bring about a denial of service.
In addition, the attacker must be authorized to execute function modules in transaction SE37 (authorization object S_DEVELOP with activity 03 or 16 depending on the release in accordance with Notes 587410, 1525695 and 1357258).
Depending on the source code added, the attacker can obtain unauthorized access to data and change or delete it; the attacker can also change system output or create new users, and bring about a denial of service.
Как исправить
Implement the attached correction instructions.
Ссылки
