Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1523140-4)
SAP Support Packages
(SAPK-31220INCPROJECT, SAPK-31420INCPROJECT, SAPK-40019INCPRXRPM)
Описание
PPM-PRO executes certain functions through referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the user.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
If present, the attacker may use a Cross Site Scripting attack to trigger the exploit, or use an approach in which a link to click is presented to the victim.
Как исправить
Implement the correction instructions of this note. This will also create the report BSP_XSRF_PARAM_CPROJECTS in your system.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPROJECTS cProject Suite |
| Release 300 All Support Package Levels |
| Release 310_620 Until SAPK-31219INCPROJECT |
| Release 310_640 Until SAPK-31419INCPROJECT |
------------------------------------------------------------------------
Please implement note 1520324 first.
The corrections from note 1520324 are a prerequisite for implementation of this note.
You can find additional information and instructions in this note.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPRXRPM SAP Project Por...|
| Release 400 Until SAPK-40018INCPRXRPM |
------------------------------------------------------------------------
Please implement note 1520324 first.
The corrections from note 1520324 are a prerequisite for implementation of this note.
You can find additional information and instructions in this note.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPROJECTS cProject Suite |
| Release 300 All Support Package Levels |
| Release 310_620 Until SAPK-31219INCPROJECT |
| Release 310_640 Until SAPK-31419INCPROJECT |
------------------------------------------------------------------------
Execute the report BSP_XSRF_PARAM_CPROJECTS and specify when requested a corresponding transport request number. The report will fill the database table BSPTEMPXSRFSTORE with corresponding table entries for theBSP applications adapted by this note.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPRXRPM SAP Project Por...|
| Release 400 Until SAPK-40018INCPRXRPM |
------------------------------------------------------------------------
Execute the report BSP_XSRF_PARAM_CPROJECTS and specify when requested a corresponding transport request number. The report will fill the database table BSPTEMPXSRFSTORE with corresponding table entries for the BSP applications adapted by this note.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPROJECTS cProject Suite |
| Release 300 All Support Package Levels |
| Release 310_620 Until SAPK-31219INCPROJECT |
| Release 310_640 Until SAPK-31419INCPROJECT |
------------------------------------------------------------------------
Please implement note 1520324 first.
The corrections from note 1520324 are a prerequisite for implementation of this note.
You can find additional information and instructions in this note.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPRXRPM SAP Project Por...|
| Release 400 Until SAPK-40018INCPRXRPM |
------------------------------------------------------------------------
Please implement note 1520324 first.
The corrections from note 1520324 are a prerequisite for implementation of this note.
You can find additional information and instructions in this note.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPROJECTS cProject Suite |
| Release 300 All Support Package Levels |
| Release 310_620 Until SAPK-31219INCPROJECT |
| Release 310_640 Until SAPK-31419INCPROJECT |
------------------------------------------------------------------------
Execute the report BSP_XSRF_PARAM_CPROJECTS and specify when requested a corresponding transport request number. The report will fill the database table BSPTEMPXSRFSTORE with corresponding table entries for theBSP applications adapted by this note.
------------------------------------------------------------------------
|Manual Post-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component CPRXRPM SAP Project Por...|
| Release 400 Until SAPK-40018INCPRXRPM |
------------------------------------------------------------------------
Execute the report BSP_XSRF_PARAM_CPROJECTS and specify when requested a corresponding transport request number. The report will fill the database table BSPTEMPXSRFSTORE with corresponding table entries for the BSP applications adapted by this note.
Ссылки
