Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1644896-2)
SAP Support Packages
(BPEM_HUMAN_INTERFACE_MGMT_730_SP007_000000, BPEM_HUMAN_INTERFACE_MGMT_730_SP999999_999999, BPEM_HUMAN_INTERFACE_MGMT_731_SP002_000000, BPEM_HUMAN_INTERFACE_MGMT_731_SP999999_999999, BPEM_NWA_PLUG_INS_720_SP007_000001, BPEM_NWA_PLUG_INS_720_SP008_000000, BPEM_NWA_PLUG_INS_720_SP999999_999999, BPEM_NWA_PLUG_INS_730_SP007_000003, BPEM_NWA_PLUG_INS_730_SP008_000000, BPEM_NWA_PLUG_INS_730_SP999999_999999, BPEM_NWA_PLUG_INS_731_SP002_000002, BPEM_NWA_PLUG_INS_731_SP003_000000, BPEM_NWA_PLUG_INS_731_SP999999_999999, BPEM_WEBDYNPRO_UIS_711_SP006_000002, BPEM_WEBDYNPRO_UIS_711_SP007_000001, BPEM_WEBDYNPRO_UIS_711_SP008_000001, BPEM_WEBDYNPRO_UIS_711_SP009_000001, BPEM_WEBDYNPRO_UIS_711_SP010_000000, BPEM_WEBDYNPRO_UIS_711_SP999999_999999, BPEM_WEBDYNPRO_UIS_720_SP007_000001, BPEM_WEBDYNPRO_UIS_720_SP008_000000, BPEM_WEBDYNPRO_UIS_720_SP999999_999999, BPEM_WEBDYNPRO_UIS_730_SP007_000004, BPEM_WEBDYNPRO_UIS_730_SP008_000000, BPEM_WEBDYNPRO_UIS_730_SP999999_999999, BPEM_WEBDYNPRO_UIS_731_SP002_000002, BPEM_WEBDYNPRO_UIS_731_SP003_000001, BPEM_WEBDYNPRO_UIS_731_SP999999_999999)
Описание
SAP NetWeaver BPM Task Management does not contain authorization checks for checking an authenticated user's authorization to receive delegated tasks. This may result in undesired system behavior.
Как исправить
By applying the correction contained in one of the SPs listed in the table below, the behavior of the UME Principal Selector Dialog used in the context of SAP NetWeaver BPM Task Management will be changed as follows:
Upon searches the dialog will only return UME users that belong to the "BPEM End User" role (unique name: "pcd:portal_content/com.sap.pct/every_user/com.sap.bpem/com.sap.bpem.roles/com.sap.bpem.Enduser"). I.e. that this role will be added as an implicit, additional search criterion.
As this selector dialog is used to select the user to delegate a task to, it is no longer possible to delegate SAP NetWeaver BPM Tasks to any UME user.
Upon searches the dialog will only return UME users that belong to the "BPEM End User" role (unique name: "pcd:portal_content/com.sap.pct/every_user/com.sap.bpem/com.sap.bpem.roles/com.sap.bpem.Enduser"). I.e. that this role will be added as an implicit, additional search criterion.
As this selector dialog is used to select the user to delegate a task to, it is no longer possible to delegate SAP NetWeaver BPM Tasks to any UME user.
Ссылки
