Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1649441-2)
SAP Support Packages
(SAPKITLRA6, SAPKITLRB6)
Описание
The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is required. This user needs authorization to create and execute Abap reports or to execute function modules (SE37). Depending on the code, the user can:
inject and run their own code,
obtain additional information that should not be displayed,
modify data, delete data,
modify the output of the system,
create new users with higher privileges,
perform a denial-of-service attack.
inject and run their own code,
obtain additional information that should not be displayed,
modify data, delete data,
modify the output of the system,
create new users with higher privileges,
perform a denial-of-service attack.
Как исправить
This problem only occurs in ST-PI releases 2008_1_* with support package 04 or lower. In this case please install a recent version of ST-PI (ST-PI 2008_1_* with support package 05 or higher).
Ссылки
