Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1632105-1)
SAP Support Packages
(EXP:_BSC_IDM_STANDARD_120_SP002_000004, EXP:_BSC_IDM_STANDARD_120_SP999999_999999)
Описание
Codename: Edison contains HTTP verb tampering vulnerabilities. This means that there is a risk of information disclosure or data tampering if an attacker accesses the application using HTTP requests that contain unexpected HTTP methods.
Prerequisites:
1. Never assign "SAP_ungranted_role" to any user.
2. Ensure that SAP Note 1445998 is implemented to disable InvokerServlet (not required for SAP NetWeaver 7.20 SP03 and above). While HTTP verb tampering and InvokerServlet problems and solutions are not prerequisites of each other, we still recommend both fixes.
Prerequisites:
1. Never assign "SAP_ungranted_role" to any user.
2. Ensure that SAP Note 1445998 is implemented to disable InvokerServlet (not required for SAP NetWeaver 7.20 SP03 and above). While HTTP verb tampering and InvokerServlet problems and solutions are not prerequisites of each other, we still recommend both fixes.
Как исправить
Apply Codename: Edison SP2 Patch 2.
Ссылки
