Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1535301-1)
Описание
Как исправить
The application shall not rely on the Invoker Servlet feature but use local servlets, i.e. defined in its own web.xml file only. In general the change can be done entirely in the web.xml file of the application (no code changes required). For all servlets the application accesses through the "/servlet/" prefix, define appropriate servlet-mapping. For example, if you have an URL http://host/myContextRoot/servlet/myServlet, then you need to define the following servlet-mapping tag:
<servlet-mapping>
<servlet-name>myServlet</servlet-name>
<url-pattern>/servlet/myServlet/*</url-pattern>
</servlet-mapping>
The Invoker Serlvet issue is fixed in the AMC Web Editor Demo Application starting from the following AMC versions:
AMC 2.0 applet version 180
AMC 3.0 applet version 163
The modified web.xml files are listed below:
Software Component: ISM-AMC-WB
Development Components: /is/ism/amc/web/client, /is/ism/amc/web/monitor
Software Component: ISM-AMC-WE
Development Components: /is/ism/amc/web/editor/servlet
Since the fix is similar in these files, here is the content of one "web.xml" file as an example:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>WEB APP</display-name>
<description>WEB APP description</description>
<servlet>
<servlet-name>WebEditorServlet</servlet-name>
<servlet-class>com.sap.ism.amc.web.editor.server.WebEditorServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>WebEditorServlet</servlet-name>
<url-pattern>/servlet/WebEditorServlet/*</url-pattern>
</servlet-mapping>
</web-app>
<servlet-mapping>
<servlet-name>myServlet</servlet-name>
<url-pattern>/servlet/myServlet/*</url-pattern>
</servlet-mapping>
The Invoker Serlvet issue is fixed in the AMC Web Editor Demo Application starting from the following AMC versions:
AMC 2.0 applet version 180
AMC 3.0 applet version 163
The modified web.xml files are listed below:
Software Component: ISM-AMC-WB
Development Components: /is/ism/amc/web/client, /is/ism/amc/web/monitor
Software Component: ISM-AMC-WE
Development Components: /is/ism/amc/web/editor/servlet
Since the fix is similar in these files, here is the content of one "web.xml" file as an example:
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE web-app PUBLIC "-//Sun Microsystems, Inc.//DTD Web Application 2.3//EN" "http://java.sun.com/dtd/web-app_2_3.dtd">
<web-app>
<display-name>WEB APP</display-name>
<description>WEB APP description</description>
<servlet>
<servlet-name>WebEditorServlet</servlet-name>
<servlet-class>com.sap.ism.amc.web.editor.server.WebEditorServlet</servlet-class>
</servlet>
<servlet-mapping>
<servlet-name>WebEditorServlet</servlet-name>
<url-pattern>/servlet/WebEditorServlet/*</url-pattern>
</servlet-mapping>
</web-app>
Ссылки
