Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1538139-1)
Описание
Web container service property for session fixation protection SessionIdRegenerationEnabled is set to true and causes session identifier regeneration.
The grace period defined in the SecuritySessionIdGracePeriod property of web container is bigger than 0 and Session Fixation Protection of the corresponding policy configuration is set to "Grace period".
The first request to the backend system that performs the authentication is long running one and may be canceled by the user. As a result the session identifier is not sent to the client due to the cancellation and all the subsequent requests received after the grace period are considered as hacker requests and rejected with the exception cited in symptom.
The grace period defined in the SecuritySessionIdGracePeriod property of web container is bigger than 0 and Session Fixation Protection of the corresponding policy configuration is set to "Grace period".
The first request to the backend system that performs the authentication is long running one and may be canceled by the user. As a result the session identifier is not sent to the client due to the cancellation and all the subsequent requests received after the grace period are considered as hacker requests and rejected with the exception cited in symptom.
Как исправить
The feature "SAP Logon Tickets for Multiple Domains" must be enabled. With this functionality when the user logs in the consumer portal, they are automatically logged in into the producer portal as well. Subsequent requests do not trigger authentication as they are already authenticated. As a result the cancelation of the long running request doesn't impact any subsequent requests.
The consumer portal UME needs to be configured with multi-domain cookie as per http://help.sap.com/saphelp_nw2004s/helpdata/en/e0/fa984050a13354e10000000a1550b0/frameset.htm
This solution should be applied even in the case when all portals are in the same domain despite the fact that it was originally designed for portals in different domains.
The consumer portal UME needs to be configured with multi-domain cookie as per http://help.sap.com/saphelp_nw2004s/helpdata/en/e0/fa984050a13354e10000000a1550b0/frameset.htm
This solution should be applied even in the case when all portals are in the same domain despite the fact that it was originally designed for portals in different domains.
Ссылки
