Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/Au:N/C:P/I:P/A:P)
Производитель ПО
Наименование ПО
SAP Notes
(1548548-5)
SAP Support Packages
(SAP_J2EE_ENGINE_640_SP024_000009, SAP_J2EE_ENGINE_640_SP025_000014, SAP_J2EE_ENGINE_640_SP026_000011, SAP_J2EE_ENGINE_640_SP027_000004, SAP_J2EE_ENGINE_640_SP999999_999999, SAP_JAVA_TECH_SERVICES_640_SP028_000000, SAP_JAVA_TECH_SERVICES_640_SP999999_999999, SAP_JAVA_TECH_SERVICES_700_SP020_000022, SAP_JAVA_TECH_SERVICES_700_SP021_000023, SAP_JAVA_TECH_SERVICES_700_SP022_000014, SAP_JAVA_TECH_SERVICES_700_SP023_000002, SAP_JAVA_TECH_SERVICES_700_SP024_000000, SAP_JAVA_TECH_SERVICES_700_SP999999_999999, SAP_JAVA_TECH_SERVICES_701_SP005_000022, SAP_JAVA_TECH_SERVICES_701_SP006_000021, SAP_JAVA_TECH_SERVICES_701_SP007_000011, SAP_JAVA_TECH_SERVICES_701_SP008_000001, SAP_JAVA_TECH_SERVICES_701_SP009_000000, SAP_JAVA_TECH_SERVICES_701_SP999999_999999, SAP_JAVA_TECH_SERVICES_702_SP003_000013, SAP_JAVA_TECH_SERVICES_702_SP004_000013, SAP_JAVA_TECH_SERVICES_702_SP005_000007, SAP_JAVA_TECH_SERVICES_702_SP006_000004, SAP_JAVA_TECH_SERVICES_702_SP007_000000, SAP_JAVA_TECH_SERVICES_702_SP999999_999999)
Описание
BCB does not contain sufficient authentication checks for authenticating a user. Information relating to the Business Communication Broker can be discovered. This may result in undesired system behavior.
Как исправить
If you do not use the JAVA runtime of BCB, simply stop BCB (Java). This can be done within Deploy Service in the Visual Administrator. The application to be stopped is named "tc/bcb/ici". This leads to the deactivation of the Web applications "bcbadm" (BCB Administration) and "ccsui" (SAP Contact Center Simulator).
If you need to use the JAVA runtime of BCB, please upgrade to the latest Support Package or deploy a patch with the appropriate patch level. The minimum patch level information is provided in the "SP Patch Level" section of this note.
The ABAP runtime of BCB is not affected by stopping the JAVA runtime of BCB as both runtimes operate independently
If you need to use the JAVA runtime of BCB, please upgrade to the latest Support Package or deploy a patch with the appropriate patch level. The minimum patch level information is provided in the "SP Patch Level" section of this note.
The ABAP runtime of BCB is not affected by stopping the JAVA runtime of BCB as both runtimes operate independently
Ссылки
