Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(627649-3)
Описание
Prerequisite for the credit card data being written to the log files is that the log level for com.sapmarkets.isa was set to DEBUG. The DEBUG setting is always only meant for test purposes and should never be used on production systems except for the problem analysis. The standard level for the productive operation should be ERROR since with this setting, the system only generates entries if errors occur. For more information on the different log levels and the configuration, see the 'ISA 3.1 CRM E-Selling: Business Scenario Configuration Guide' document which can be downloaded from the Service Marketplace.
The document actually refers in particular to ISA 3.1, however, the 'Logging' chapter is also valid for ISA 3.0 and ISA 4.0.
The document actually refers in particular to ISA 3.1, however, the 'Logging' chapter is also valid for ISA 3.0 and ISA 4.0.
Как исправить
The correction makes sure that no more credit card information is written to the isa.log files regardless of the log level you set.
The correction is included in Release 3.0 as of Support Package 16, in Release 3.1 as of Support Package 06 and in Release 4.0 as of Support Package 02. As of the end of calendar week 29/2003, a correction is available in Support Package 12 for CRM 3.0 and in Support Package 13 for CRM 3.0 on the Service Marketplace. As of calendar week 14/2004, you will also find a correction in Support Package 14 for CRM3.0.
For other support packages, a correction can be provided as an advance correction if requested. For this purpose, create a corresponding SAPNet R/3 Frontend message with a reference to this note.
The following files were changed: WrapperCrmIsa.java, Payment.java, checkout.jsp, MaintainCheckoutB2CBaseAction.java, CCardStrategyR3, CCardStrategyR340b und CCardStrategyR3PI.
The correction is included in Release 3.0 as of Support Package 16, in Release 3.1 as of Support Package 06 and in Release 4.0 as of Support Package 02. As of the end of calendar week 29/2003, a correction is available in Support Package 12 for CRM 3.0 and in Support Package 13 for CRM 3.0 on the Service Marketplace. As of calendar week 14/2004, you will also find a correction in Support Package 14 for CRM3.0.
For other support packages, a correction can be provided as an advance correction if requested. For this purpose, create a corresponding SAPNet R/3 Frontend message with a reference to this note.
The following files were changed: WrapperCrmIsa.java, Payment.java, checkout.jsp, MaintainCheckoutB2CBaseAction.java, CCardStrategyR3, CCardStrategyR340b und CCardStrategyR3PI.
Ссылки
