Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1672882-2)
SAP Support Packages
(PORTAL_FRAMEWORK_700_SP023_000013, PORTAL_FRAMEWORK_700_SP024_000013, PORTAL_FRAMEWORK_700_SP025_000012, PORTAL_FRAMEWORK_700_SP026_000005, PORTAL_FRAMEWORK_700_SP999999_999999, PORTAL_FRAMEWORK_701_SP008_000011, PORTAL_FRAMEWORK_701_SP009_000010, PORTAL_FRAMEWORK_701_SP010_000009, PORTAL_FRAMEWORK_701_SP011_000001, PORTAL_FRAMEWORK_701_SP012_000000, PORTAL_FRAMEWORK_701_SP999999_999999, PORTAL_FRAMEWORK_702_SP006_000015, PORTAL_FRAMEWORK_702_SP007_000011, PORTAL_FRAMEWORK_702_SP008_000012, PORTAL_FRAMEWORK_702_SP009_000010, PORTAL_FRAMEWORK_702_SP010_000009, PORTAL_FRAMEWORK_702_SP011_000003, PORTAL_FRAMEWORK_702_SP012_000000, PORTAL_FRAMEWORK_702_SP999999_999999, PORTAL_PLATFORM_60_640_SP027_000011, PORTAL_PLATFORM_60_640_SP028_000008, PORTAL_PLATFORM_60_640_SP029_000005, PORTAL_PLATFORM_60_640_SP030_000000, PORTAL_PLATFORM_60_640_SP031_000000, PORTAL_PLATFORM_60_640_SP999999_999999)
Описание
User Mapping Portal component application executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.
The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
Как исправить
To apply XSRF protection for User Mapping Portal component application please update the AS Java to the latest patch level as specified in the SP Patch level section.
Ссылки
