Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1675511-5)
SAP Support Packages
(SAPK-30012INFSAPPL, SAPK-40003INFSAPPL)
Описание
The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. The developer authorization(object 'S_DEVELOP') is required, to execute the injected code. Depending on the code, the user can:
inject and run their own code,
obtain additional information that should not be displayed,
modify data, delete data,
modify the output of the system,
create new users with higher privileges,
perform a denial-of-service attack.
inject and run their own code,
obtain additional information that should not be displayed,
modify data, delete data,
modify the output of the system,
create new users with higher privileges,
perform a denial-of-service attack.
Как исправить
Please install the attached correction or the corresponding support package.
After implementation of this note, you can use these steps if you have no developer authorization. Please note that you can only use predefined commands(condition, formula and table loop), technically you can enter only one sentence. Additionally, you can also enter more sentences only if you have the developer authorization.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FSAPPL Financial Servi...|
| Release 300 SAPK-30001INFSAPPL - SAPK-30011INFSAPPL |
| Release 400 Until SAPK-40002INFSAPPL |
------------------------------------------------------------------------
1. Change message /BA1/P3_CT_CUST520
Execute transaction SE91 -> enter message class /BA1/P3_CT_CUST, message number 520 -> change mode -> copy the text as follows:
In English
You are not authorized to process the step &1
In German
Sie besitzen keine Berechtigung um den Schritte &1 zu bearbeiten
2. Add text elements
Execute transaction SE24 -> enter class /BA1/P3_CL_STP -> change mode -> go to menu 'Goto' -> text element -> add the following texts:
In German
Sym Text dLen mLen
ST1 Formel 6 10
ST2 Bedingung 9 15
ST3 Tabellen-Schleife 17 17
In English
Sym Text dLen mLen
ST1 Formula 4 10
ST2 Condition 9 15
ST3 Table Loop 17 17
After implementation of this note, you can use these steps if you have no developer authorization. Please note that you can only use predefined commands(condition, formula and table loop), technically you can enter only one sentence. Additionally, you can also enter more sentences only if you have the developer authorization.
------------------------------------------------------------------------
|Manual Pre-Implement. |
------------------------------------------------------------------------
|VALID FOR |
|Software Component FSAPPL Financial Servi...|
| Release 300 SAPK-30001INFSAPPL - SAPK-30011INFSAPPL |
| Release 400 Until SAPK-40002INFSAPPL |
------------------------------------------------------------------------
1. Change message /BA1/P3_CT_CUST520
Execute transaction SE91 -> enter message class /BA1/P3_CT_CUST, message number 520 -> change mode -> copy the text as follows:
In English
You are not authorized to process the step &1
In German
Sie besitzen keine Berechtigung um den Schritte &1 zu bearbeiten
2. Add text elements
Execute transaction SE24 -> enter class /BA1/P3_CL_STP -> change mode -> go to menu 'Goto' -> text element -> add the following texts:
In German
Sym Text dLen mLen
ST1 Formel 6 10
ST2 Bedingung 9 15
ST3 Tabellen-Schleife 17 17
In English
Sym Text dLen mLen
ST1 Formula 4 10
ST2 Condition 9 15
ST3 Table Loop 17 17
Ссылки
