Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1511751-4)
SAP Support Packages
(SAPK-41021INSCMBASIS, SAPK-50019INSCMBASIS, SAPK-51015INSCMSNC, SAPK-70009INSCMSNC, SAPK-70103INSCMSNC)
Описание
SNC executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
Как исправить
Perform the attached manual corrections.
As a pre-requisite, install note 1508661.
For SNC releases 7.0 and below, as a pre-requisite, install note 1520324.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMSNC Supply Network... |
| Release 701 Until SAPK-70102INSCMSNC |
------------------------------------------------------------------------
The following BSP applications will be deleted:
/SCF/CB_HTML
/SCF/COLLABORATION
/SCF/STYLES
/SCF/UIBSP
Perform the following steps for each of the 4 application mentioned above to delete them.
1. Log in to the SNC system, and start transaction SE80.
2. Click "Repository Browser", and choose "BSP Application" from the dropdown list.
3. Enter the name of the application to be deleted into the input box below the dropdown list. Press Enter, or press the display button next to the input box.
4. Below the input box now is the BSP application. Right click the application name, and choose "Delete".
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMSNC Supply Network... |
| Release 510 Until SAPK-51014INSCMSNC |
| Release 700 Until SAPK-70008INSCMSNC |
------------------------------------------------------------------------
Execute report '/SCF/BSP_XSRF_PARAM_SNC'.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCM_BASIS Supply Chain Ma...|
| Release 410 Until SAPK-41020INSCMBASIS |
| Release 500 Until SAPK-50018INSCMBASIS |
------------------------------------------------------------------------
Execute report '/SCF/BSP_XSRF_PARAM_SNC'.
As a pre-requisite, install note 1508661.
For SNC releases 7.0 and below, as a pre-requisite, install note 1520324.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMSNC Supply Network... |
| Release 701 Until SAPK-70102INSCMSNC |
------------------------------------------------------------------------
The following BSP applications will be deleted:
/SCF/CB_HTML
/SCF/COLLABORATION
/SCF/STYLES
/SCF/UIBSP
Perform the following steps for each of the 4 application mentioned above to delete them.
1. Log in to the SNC system, and start transaction SE80.
2. Click "Repository Browser", and choose "BSP Application" from the dropdown list.
3. Enter the name of the application to be deleted into the input box below the dropdown list. Press Enter, or press the display button next to the input box.
4. Below the input box now is the BSP application. Right click the application name, and choose "Delete".
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMSNC Supply Network... |
| Release 510 Until SAPK-51014INSCMSNC |
| Release 700 Until SAPK-70008INSCMSNC |
------------------------------------------------------------------------
Execute report '/SCF/BSP_XSRF_PARAM_SNC'.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCM_BASIS Supply Chain Ma...|
| Release 410 Until SAPK-41020INSCMBASIS |
| Release 500 Until SAPK-50018INSCMBASIS |
------------------------------------------------------------------------
Execute report '/SCF/BSP_XSRF_PARAM_SNC'.
Ссылки
