Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1597489-5)
SAP Support Packages
(712, SAPK-51016INSCMEWM, SAPK-70010INSCMEWM, SAPK-70106INSCMEWM, SAPK-70201INSCMEWM)
Описание
SCMEWM executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user#s browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.
The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.
Как исправить
Note that the note contains only manual activities.
1. For additional information and instructions, see SAP Note 1481392. The corrections from SAP Note 1481392 are a prerequisite for implementing this SAP Note.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 700 SAPK-70001INSCMEWM - SAPK-70009INSCMEWM |
------------------------------------------------------------------------
Note that Note 1571684 is a prerequisite for this note.
Add additional parameters to the ICF service RFUI in the GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 701 SAPK-70101INSCMEWM - SAPK-70105INSCMEWM |
------------------------------------------------------------------------
Note that SAP Note 1571684 is a prerequisite for this SAP Note.
Add additional parameters to the ICF service RFUI in the GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 702 SAPK-70201INSCMEWM - SAPK-70201INSCMEWM |
------------------------------------------------------------------------
Note that SAP Note 1571684 is a prerequisite for this SAP Note.
Add additional parameters to the ICF service RFUI in the GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 510 SAPK-51001INSCMEWM - SAPK-51015INSCMEWM |
------------------------------------------------------------------------
Note that SAP Note 1571684 is a prerequisite for this SAP Note.
Add additional parameters to the ICF service RFUI in the
GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
1. For additional information and instructions, see SAP Note 1481392. The corrections from SAP Note 1481392 are a prerequisite for implementing this SAP Note.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 700 SAPK-70001INSCMEWM - SAPK-70009INSCMEWM |
------------------------------------------------------------------------
Note that Note 1571684 is a prerequisite for this note.
Add additional parameters to the ICF service RFUI in the GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 701 SAPK-70101INSCMEWM - SAPK-70105INSCMEWM |
------------------------------------------------------------------------
Note that SAP Note 1571684 is a prerequisite for this SAP Note.
Add additional parameters to the ICF service RFUI in the GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 702 SAPK-70201INSCMEWM - SAPK-70201INSCMEWM |
------------------------------------------------------------------------
Note that SAP Note 1571684 is a prerequisite for this SAP Note.
Add additional parameters to the ICF service RFUI in the GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SCMEWM Extended Wareho...|
| Release 510 SAPK-51001INSCMEWM - SAPK-51015INSCMEWM |
------------------------------------------------------------------------
Note that SAP Note 1571684 is a prerequisite for this SAP Note.
Add additional parameters to the ICF service RFUI in the
GUI configuration.
To do this, start transaction SICF (Maintain Services).
Check whether the hierarchy type is prepopulated with SERVICE.
Enter RFUI in the "Service Name" field.
Choose "Execute" (or the F8 function key).
Open the service setting by double-clicking the service.
Choose "GUI Configuration".
Enter the following data at the end of the parameter list:
Parameter Name: ~XSRFCHECK
Value: 1
Parameter Name: ~OKCODE_PERMIT
Value: ENT, F1, F2, F3, F4, F5, F6, F7, F8, F9, F10, F11, F12, CSF1
Choose "Enter".
Save your changes.
You must now regenerate and publish all the HTML templates used in the RF transactions
(SAP standard and customer-defined).
Use the report SIAC_REGENERATE_TEMPLATES for this.
Use transaction SA38 (ABAP: Program Execution) to start the report.
Enter the name of the service (/SCWM/RFUI) and the subject (99) and choose "Execute" (or the F8 function key).
Select the suitable generating style "Mobile Devices (Preserving Layout)" (MOBILE).
Check whether the "Publish Automatically (Internal)" field is set.
Check whether all templates are selected.
Choose "Regenerate" (or the F8 function key).
Ссылки
