Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1749777-2)
SAP Support Packages
(BI_BASE_SERVICES_700_SP028_000000, BI_BASE_SERVICES_700_SP999999_999999, BI_BASE_SERVICES_701_SP013_000000, BI_BASE_SERVICES_701_SP999999_999999, BI_WEB_APPLICATIONS_700_SP028_000000, BI_WEB_APPLICATIONS_700_SP999999_999999, BI_WEB_APPLICATIONS_701_SP013_000000, BI_WEB_APPLICATIONS_701_SP999999_999999, HM_BI_BASE_S_700_SP028_000000, HM_BI_BASE_S_700_SP999999_999999, HM_BI_BASE_S_701_SP013_000000, HM_BI_BASE_S_701_SP999999_999999)
Описание
Business Warehouse uses the unified rendering to display reports.
Rendering within unified rendering does not sufficiently encode HTML-OUTPUT parameters, resulting in a reflected cross-site scripting issue.
A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a Web site.
Reflected cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session.
An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
Due to SAP Note 1637338, changes were made to Business Warehouse in the build process. The solution proposed here ensures that the central and continuously updated library closes the security hole mentioned here.
Rendering within unified rendering does not sufficiently encode HTML-OUTPUT parameters, resulting in a reflected cross-site scripting issue.
A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a Web site.
Reflected cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session.
An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
Due to SAP Note 1637338, changes were made to Business Warehouse in the build process. The solution proposed here ensures that the central and continuously updated library closes the security hole mentioned here.
Как исправить
SAP NetWeaver 7.0 BI Java
Import Support Package 28 for SAP NetWeaver 7.0 BI Java into your BI system. For more information, see SAP Note 1724450.
In urgent cases, you can implement the corrections by applying BI Java patches:
Apply BI Java Patch SP27 #10 (Support Package 27, Patch level 10) for SAP NetWeaver 7.0 BI Java to your BI system. For more information, refer to Note 1706344.
SAP NetWeaver BI 7.01 (SAP NW BI 7.0 Enhancement Package 1)
Import Support Package 13 for SAP NW BI 7.0 EhP 1 BI JAVA into your BI system. For more information, see SAP Note 1724503.
In urgent cases, you can implement the corrections by applying BI Java patches:
Apply BI Java Patch SP011 #40 (Support Package 11, Patch level 40) for SAP Enhancement Package 1 for NetWeaver 7.0 (7.01) BI Java to your BI system. For more information, see SAP Note 1706292.
All SAP Notes mentioned in this SAP Note will be available when the corresponding Support Package or patch is released in SAP Service Marketplace.
Refer to information note 1506722 for more details. It contains general information about BI Java patches and Support Packages.
Import Support Package 28 for SAP NetWeaver 7.0 BI Java into your BI system. For more information, see SAP Note 1724450.
In urgent cases, you can implement the corrections by applying BI Java patches:
Apply BI Java Patch SP27 #10 (Support Package 27, Patch level 10) for SAP NetWeaver 7.0 BI Java to your BI system. For more information, refer to Note 1706344.
SAP NetWeaver BI 7.01 (SAP NW BI 7.0 Enhancement Package 1)
Import Support Package 13 for SAP NW BI 7.0 EhP 1 BI JAVA into your BI system. For more information, see SAP Note 1724503.
In urgent cases, you can implement the corrections by applying BI Java patches:
Apply BI Java Patch SP011 #40 (Support Package 11, Patch level 40) for SAP Enhancement Package 1 for NetWeaver 7.0 (7.01) BI Java to your BI system. For more information, see SAP Note 1706292.
All SAP Notes mentioned in this SAP Note will be available when the corresponding Support Package or patch is released in SAP Service Marketplace.
Refer to information note 1506722 for more details. It contains general information about BI Java patches and Support Packages.
Ссылки
