Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1537215-3)
SAP Support Packages
(SAPKB71012, SAPKB71107)
Описание
The program code contains a hard-coded username that changes the system's behaviour if a user is successfully authenticated. The user may obtain additional in-formation that should not be displayed.
The vulnerability is caused by a hard-coded username-password com-bination in the program's source code. A malicious user who specifies these credentials can log on to the system without having been assigned legitimate access by the system administra-tor(s). If a user already has privileges with which they can log on, an escalation of privileges may be possible if the hard-coded account has higher access rights than the original user.
Pre-requisite:
You are on SP08 - SP11 of WebAs 7.10
or
You are on a SP lower than SP 07 of WebAs 7.11
The vulnerability is caused by a hard-coded username-password com-bination in the program's source code. A malicious user who specifies these credentials can log on to the system without having been assigned legitimate access by the system administra-tor(s). If a user already has privileges with which they can log on, an escalation of privileges may be possible if the hard-coded account has higher access rights than the original user.
Pre-requisite:
You are on SP08 - SP11 of WebAs 7.10
or
You are on a SP lower than SP 07 of WebAs 7.11
Как исправить
Hardcoded username is removed from the Function modules.
Apply SP12 if you are on WebAs 7.10
or
Apply SP07 if you are on WebAs 7.11
Apply SP12 if you are on WebAs 7.10
or
Apply SP07 if you are on WebAs 7.11
Ссылки
