Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1529597-4)
Описание
CRM-MW-GWI user is not restricted by roles to check an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
Как исправить
Perform the steps outlined below.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 500 All Support Package Levels |
| Release 520 All Support Package Levels |
| Release 700 All Support Package Levels |
| Release 600 All Support Package Levels |
| Release 701 All Support Package Levels |
| Release 702 All Support Package Levels |
------------------------------------------------------------------------
Create a new role 'SAP_CRM_MW_GWI' using the transaction PFCG.
Add the following authorization objects to the newly created role and assign the Groupware Connector user the role 'SAP_CRM_MW_GWI'. Also the Groupware Connector user should have the user type 'Communications Data'.
SAP_CRM_MW_GWI: Role for groupware connector user
-----------------------------------------------------------------------
| Cross-application Authorization Objects |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Business Partner | B_BUPA_ATT | Authorization Types |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All activities |
-----------------------------------------------------------------------
| Authorization type | * |
-----------------------------------------------------------------------
| Authorization value (field 1) | * |
-----------------------------------------------------------------------
| Authorization value (field 2) | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Business Partner | B_BUPA_RLT | BP Roles |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All activities |
-----------------------------------------------------------------------
| BP Role | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| RFC Access | S_RFC | Authorization Check |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | Execute |
-----------------------------------------------------------------------
| Name of RFC to be protected | INTSYNC_PAYLOAD_IF |
-----------------------------------------------------------------------
| Type of RFC object to be prote| Function group |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Status Management| B_USERSTAT | Set/Delete User Status |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All Activities |
-----------------------------------------------------------------------
| Authorization key | * |
-----------------------------------------------------------------------
| Object Category | * |
-----------------------------------------------------------------------
| Status Profile | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Status Management| B_USERST_T | Set/Delete User Status |
| | | using Transaction |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All Activities |
-----------------------------------------------------------------------
| Authorization key | * |
-----------------------------------------------------------------------
| Object Category | * |
-----------------------------------------------------------------------
| Status Profile | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| CRM Component |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| CRM Order | CRM_ORD_LP | Visibility in Org. Model |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All activities |
-----------------------------------------------------------------------
| Scope of Processed Objects | All values |
-----------------------------------------------------------------------
| Business Transaction Type | * |
-----------------------------------------------------------------------
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BBPCRM BBP / CRM |
| Release 500 All Support Package Levels |
| Release 520 All Support Package Levels |
| Release 700 All Support Package Levels |
| Release 600 All Support Package Levels |
| Release 701 All Support Package Levels |
| Release 702 All Support Package Levels |
------------------------------------------------------------------------
Create a new role 'SAP_CRM_MW_GWI' using the transaction PFCG.
Add the following authorization objects to the newly created role and assign the Groupware Connector user the role 'SAP_CRM_MW_GWI'. Also the Groupware Connector user should have the user type 'Communications Data'.
SAP_CRM_MW_GWI: Role for groupware connector user
-----------------------------------------------------------------------
| Cross-application Authorization Objects |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Business Partner | B_BUPA_ATT | Authorization Types |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All activities |
-----------------------------------------------------------------------
| Authorization type | * |
-----------------------------------------------------------------------
| Authorization value (field 1) | * |
-----------------------------------------------------------------------
| Authorization value (field 2) | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Business Partner | B_BUPA_RLT | BP Roles |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All activities |
-----------------------------------------------------------------------
| BP Role | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| RFC Access | S_RFC | Authorization Check |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | Execute |
-----------------------------------------------------------------------
| Name of RFC to be protected | INTSYNC_PAYLOAD_IF |
-----------------------------------------------------------------------
| Type of RFC object to be prote| Function group |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Status Management| B_USERSTAT | Set/Delete User Status |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All Activities |
-----------------------------------------------------------------------
| Authorization key | * |
-----------------------------------------------------------------------
| Object Category | * |
-----------------------------------------------------------------------
| Status Profile | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| Status Management| B_USERST_T | Set/Delete User Status |
| | | using Transaction |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All Activities |
-----------------------------------------------------------------------
| Authorization key | * |
-----------------------------------------------------------------------
| Object Category | * |
-----------------------------------------------------------------------
| Status Profile | * |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| CRM Component |
-----------------------------------------------------------------------
-----------------------------------------------------------------------
| Application | Authorization Object | Description |
-----------------------------------------------------------------------
| CRM Order | CRM_ORD_LP | Visibility in Org. Model |
-----------------------------------------------------------------------
| Parameters | Value |
-----------------------------------------------------------------------
| Activity | All activities |
-----------------------------------------------------------------------
| Scope of Processed Objects | All values |
-----------------------------------------------------------------------
| Business Transaction Type | * |
-----------------------------------------------------------------------
Ссылки
