Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1609546-5)
SAP Support Packages
(SAPKB62071, SAPKB64029, SAPKB70026, SAPKB70111, SAPKB70210, SAPKB71014, SAPKB71108, SAPKB72006, SAPKB73005)
Описание
Some BSP pages in BC-SRV-RM results in a stored cross-site scripting issue.
It can be used to permanently modify displayed content from a Web site, allowing the malicious user to embed content that is rendered automatically, without the having to target victims individually.
Stored cross-site scripting can also be used to steal another user's authentication information, such as data relating to their current session.
A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
It can be used to permanently modify displayed content from a Web site, allowing the malicious user to embed content that is rendered automatically, without the having to target victims individually.
Stored cross-site scripting can also be used to steal another user's authentication information, such as data relating to their current session.
A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
Как исправить
It is recommended to upgrade to following SPs to apply the corrections.If this is not possible then please apply the note.
Release SP
------- ----
731 01
730 05
720 06
711 08
710 14
702 10
701 11
700 26
640 29
620 71
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 620 Until SAPKB62054 |
| Release 640 Until SAPKB64012 |
------------------------------------------------------------------------
For each of the following BSP pages, execute the steps given below to correct the issue(for releases 620 & 640):
BSP Application BSP Page
------------------- -----------------
SRMCLFRM EXCEPTION.HTM
SRMCLFRM SP.HTM
SRMCLFRM SPE.HTM
SRMCLFRM START
SRM_DEMO_BSPEXT EXAMPLE1.HTM
SRM_DEMO_BSPEXT EXAMPLE2.HTM
SRM_DEMO_BSPEXT EXAMPLE3.HTM
SRM_DEMO_NOTE IVIEW.HTM
SRM_DEMO_RECORD IVIEW.HTM
SRM_DEMO_RECORD SESSION.HTM
SRM_DOCVIEW ALPROPERTIES.HTM
SRM_DOCVIEW BUTTONS.HTM
SRM_DOCVIEW CREATE.HTM
SRM_DOCVIEW DISPLAY.HTM
SRM_DOCVIEW DISPLAYALDOC.HTM
SRM_DOCVIEW ERROR.HTM
SRM_DOCVIEW OFFICEINTEGRATION.HTM
SRM_DOCVIEW OFFICEINTEGRATIONJS.HTM
SRM_DOCVIEW PROPERTIES.HTM
SRM_DOCVIEW UPLOAD.HTM
SRM_DOC_TEST EXAMPLE3.HTM
SRM_GENSP_QUERY QUERY2.HTM
SRM_NOTE BUTTONS.HTM
SRM_NOTE NOTE.HTM
SRM_ORGANIZER ORGANIZER.HTM
SRM_ORGANIZER ORG_ELEMENTS.HTM
SRM_ORGANIZER ORG_FOLDERS.HTM
SRM_ORGANIZER ORG_NAVI.HTM
SRM_PROP DISPLAY.HTM
SRM_RECORD REC.HTM
SRM_URL BUTTONS.HTM
SRM_URL VIEW.HTM
For 620 following BSP pages also need to be corrected:
BSP Application BSP Page
------------------- -----------------
SRM_REC BUTTONS.HTM
SRM_REC MORE_COLUMNS.HTM
SRM_REC NODE_PROPERTIES.HTM
SRM_REC PROPERTIES.HTM
SRM_REC REC.HTM
SRM_REC ROW.HTM
SRM_REC TABLE_BODY.HTM
SRM_REC TABLE_HEADER.HTM
Steps to correct:
1.Execute SE80.
2.Select 'BSP Application' in the drop down & enter the BSP application name in the box below( eg SRMCLFRM) & press <enter>.
3.Select the application node & click on 'Expand all' buttont to expand the application tree structure.
4.You will see the BSP pages under 'Views' or 'Pages with flow logic' or 'Page fragments' folder.
5.Double-click the page to be changed(see the BSP page name for the application in above list) & then use 'display<->change' button to go to change mode.
6.Navigate to 'Layout' tab & replace the following statement(will be the first statement in the layout)
<%@page language="abap"%>
with following statement
<%@page language="abap" forceEncode="html"%>
7.Save & activate the page.
Release SP
------- ----
731 01
730 05
720 06
711 08
710 14
702 10
701 11
700 26
640 29
620 71
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component SAP_BASIS SAP Basis compo...|
| Release 620 Until SAPKB62054 |
| Release 640 Until SAPKB64012 |
------------------------------------------------------------------------
For each of the following BSP pages, execute the steps given below to correct the issue(for releases 620 & 640):
BSP Application BSP Page
------------------- -----------------
SRMCLFRM EXCEPTION.HTM
SRMCLFRM SP.HTM
SRMCLFRM SPE.HTM
SRMCLFRM START
SRM_DEMO_BSPEXT EXAMPLE1.HTM
SRM_DEMO_BSPEXT EXAMPLE2.HTM
SRM_DEMO_BSPEXT EXAMPLE3.HTM
SRM_DEMO_NOTE IVIEW.HTM
SRM_DEMO_RECORD IVIEW.HTM
SRM_DEMO_RECORD SESSION.HTM
SRM_DOCVIEW ALPROPERTIES.HTM
SRM_DOCVIEW BUTTONS.HTM
SRM_DOCVIEW CREATE.HTM
SRM_DOCVIEW DISPLAY.HTM
SRM_DOCVIEW DISPLAYALDOC.HTM
SRM_DOCVIEW ERROR.HTM
SRM_DOCVIEW OFFICEINTEGRATION.HTM
SRM_DOCVIEW OFFICEINTEGRATIONJS.HTM
SRM_DOCVIEW PROPERTIES.HTM
SRM_DOCVIEW UPLOAD.HTM
SRM_DOC_TEST EXAMPLE3.HTM
SRM_GENSP_QUERY QUERY2.HTM
SRM_NOTE BUTTONS.HTM
SRM_NOTE NOTE.HTM
SRM_ORGANIZER ORGANIZER.HTM
SRM_ORGANIZER ORG_ELEMENTS.HTM
SRM_ORGANIZER ORG_FOLDERS.HTM
SRM_ORGANIZER ORG_NAVI.HTM
SRM_PROP DISPLAY.HTM
SRM_RECORD REC.HTM
SRM_URL BUTTONS.HTM
SRM_URL VIEW.HTM
For 620 following BSP pages also need to be corrected:
BSP Application BSP Page
------------------- -----------------
SRM_REC BUTTONS.HTM
SRM_REC MORE_COLUMNS.HTM
SRM_REC NODE_PROPERTIES.HTM
SRM_REC PROPERTIES.HTM
SRM_REC REC.HTM
SRM_REC ROW.HTM
SRM_REC TABLE_BODY.HTM
SRM_REC TABLE_HEADER.HTM
Steps to correct:
1.Execute SE80.
2.Select 'BSP Application' in the drop down & enter the BSP application name in the box below( eg SRMCLFRM) & press <enter>.
3.Select the application node & click on 'Expand all' buttont to expand the application tree structure.
4.You will see the BSP pages under 'Views' or 'Pages with flow logic' or 'Page fragments' folder.
5.Double-click the page to be changed(see the BSP page name for the application in above list) & then use 'display<->change' button to go to change mode.
6.Navigate to 'Layout' tab & replace the following statement(will be the first statement in the layout)
<%@page language="abap"%>
with following statement
<%@page language="abap" forceEncode="html"%>
7.Save & activate the page.
Ссылки
