Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:N/C:P/I:N/A:N)
Производитель ПО
Наименование ПО
SAP Notes
(1723641-4)
SAP Support Packages
(MESSAGING_SYSTEM_SERVICE_710_SP012_000016, MESSAGING_SYSTEM_SERVICE_710_SP013_000009, MESSAGING_SYSTEM_SERVICE_710_SP014_000004, MESSAGING_SYSTEM_SERVICE_710_SP015_000000, MESSAGING_SYSTEM_SERVICE_710_SP016_000000, MESSAGING_SYSTEM_SERVICE_710_SP999999_999999, MESSAGING_SYSTEM_SERVICE_711_SP007_000013, MESSAGING_SYSTEM_SERVICE_711_SP008_000010, MESSAGING_SYSTEM_SERVICE_711_SP009_000004, MESSAGING_SYSTEM_SERVICE_711_SP010_000000, MESSAGING_SYSTEM_SERVICE_711_SP011_000000, MESSAGING_SYSTEM_SERVICE_711_SP999999_999999, MESSAGING_SYSTEM_SERVICE_720_SP004_000010, MESSAGING_SYSTEM_SERVICE_720_SP005_000005, MESSAGING_SYSTEM_SERVICE_720_SP006_000004, MESSAGING_SYSTEM_SERVICE_720_SP007_000001, MESSAGING_SYSTEM_SERVICE_720_SP008_000000, MESSAGING_SYSTEM_SERVICE_720_SP999999_999999, MESSAGING_SYSTEM_SERVICE_730_SP001_000013, MESSAGING_SYSTEM_SERVICE_730_SP002_000011, MESSAGING_SYSTEM_SERVICE_730_SP003_000016, MESSAGING_SYSTEM_SERVICE_730_SP004_000010, MESSAGING_SYSTEM_SERVICE_730_SP005_000013, MESSAGING_SYSTEM_SERVICE_730_SP007_000004, MESSAGING_SYSTEM_SERVICE_730_SP008_000000, MESSAGING_SYSTEM_SERVICE_730_SP999999_999999, MESSAGING_SYSTEM_SERVICE_731_SP001_000005, MESSAGING_SYSTEM_SERVICE_731_SP002_000006, MESSAGING_SYSTEM_SERVICE_731_SP003_000003, MESSAGING_SYSTEM_SERVICE_731_SP004_000000, MESSAGING_SYSTEM_SERVICE_731_SP005_000000, MESSAGING_SYSTEM_SERVICE_731_SP999999_999999, XI_ADAPTER_FRAMEWORK_CORE_30_SP028_000004, XI_ADAPTER_FRAMEWORK_CORE_30_SP029_000003, XI_ADAPTER_FRAMEWORK_CORE_30_SP030_000000, XI_ADAPTER_FRAMEWORK_CORE_30_SP031_000000, XI_ADAPTER_FRAMEWORK_CORE_30_SP999999_999999, XI_ADAPTER_FRAMEWORK_CORE_700_SP024_000021, XI_ADAPTER_FRAMEWORK_CORE_700_SP025_000012, XI_ADAPTER_FRAMEWORK_CORE_700_SP026_000004, XI_ADAPTER_FRAMEWORK_CORE_700_SP027_000000, XI_ADAPTER_FRAMEWORK_CORE_700_SP028_000000, XI_ADAPTER_FRAMEWORK_CORE_700_SP999999_999999, XI_ADAPTER_FRAMEWORK_CORE_701_SP009_000007, XI_ADAPTER_FRAMEWORK_CORE_701_SP010_000006, XI_ADAPTER_FRAMEWORK_CORE_701_SP011_000004, XI_ADAPTER_FRAMEWORK_CORE_701_SP012_000000, XI_ADAPTER_FRAMEWORK_CORE_701_SP013_000000, XI_ADAPTER_FRAMEWORK_CORE_701_SP999999_999999, XI_ADAPTER_FRAMEWORK_CORE_702_SP006_000011, XI_ADAPTER_FRAMEWORK_CORE_702_SP007_000010, XI_ADAPTER_FRAMEWORK_CORE_702_SP008_000012, XI_ADAPTER_FRAMEWORK_CORE_702_SP009_000006, XI_ADAPTER_FRAMEWORK_CORE_702_SP010_000004, XI_ADAPTER_FRAMEWORK_CORE_702_SP011_000002, XI_ADAPTER_FRAMEWORK_CORE_702_SP012_000000, XI_ADAPTER_FRAMEWORK_CORE_702_SP013_000000, XI_ADAPTER_FRAMEWORK_CORE_702_SP999999_999999)
Описание
The problem is caused by a program error in XI Adapter Framework due to the incorrect use of an XML parser.
By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed.
This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rending application content temporarily unavailable.
By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed.
This malicious content can reference internal resources, such as files. These internal resources can be disclosed in the response to the request, or can be used to perform a denial of service attack on the parsing system, rending application content temporarily unavailable.
Как исправить
Apply the corresponding patch for your SP version. See the 'SP Patch
Level' information in this note.
Refer to SAP Note 952402 regarding how to find the archives on the SAP
Service Marketplace.
Level' information in this note.
Refer to SAP Note 952402 regarding how to find the archives on the SAP
Service Marketplace.
Ссылки
