Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1537216-4)
SAP Support Packages
(SAPKB71012, SAPKB71107)
Описание
The program code contains a possibility to define and execute user-defined code that changes the behavior of the system.
Depending on the code, the user can:
1. Inject and run their own code,
2. Obtain additional information that should not be displayed,
3. Modify data, delete data,
4. Modify the output of the system,
5. Create new users with higher privileges,
6. Perform a denial of service attack.
Pre-requisite:
You are on SP08 - SP11 of WebAs 7.10
or
You are on a SP lower than SP 07 of WebAs 7.11
Depending on the code, the user can:
1. Inject and run their own code,
2. Obtain additional information that should not be displayed,
3. Modify data, delete data,
4. Modify the output of the system,
5. Create new users with higher privileges,
6. Perform a denial of service attack.
Pre-requisite:
You are on SP08 - SP11 of WebAs 7.10
or
You are on a SP lower than SP 07 of WebAs 7.11
Как исправить
These statements are removed.
Apply SP12 if you are on WebAs 7.10
or
Apply SP07 if you are on WebAs 7.11
Apply SP12 if you are on WebAs 7.10
or
Apply SP07 if you are on WebAs 7.11
Ссылки
