Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1706527-3)
SAP Support Packages
(SAPK-70508INBICONT, SAPK-70605INBICONT, SAPK-73507INBICONT, SAPK-73603INBICONT, SAPK-74603INBICONT)
Описание
BW-BCT-PLA-MCB executes certain functions by referencing specific URLs.
When malicious user tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.
The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.
Pages within BW-BCT-PLA-MCB do not sufficiently encode INPUT parameters, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a Web site.
Reflected cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. An attacker, who gains access to this data, may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
When malicious user tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.
The malicious user may use a cross-site scripting attack to do this, or they may present a link to the victim.
Pages within BW-BCT-PLA-MCB do not sufficiently encode INPUT parameters, resulting in a reflected cross-site scripting issue. A reflected cross-site scripting attack can be used to non-permanently deface or modify displayed content from a Web site.
Reflected cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. An attacker, who gains access to this data, may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
Как исправить
Perform the manual activities described in the attached correction instructions or implement the following BI Content support packages:
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BI_CONT Business Intell...|
| Release 705 SAPK-70501INBICONT - SAPK-70507INBICONT |
| Release 735 Until SAPK-73506INBICONT |
| Release 706 SAPK-70601INBICONT - SAPK-70604INBICONT |
| Release 736 SAPK-73601INBICONT - SAPK-73602INBICONT |
| Release 746 SAPK-74601INBICONT - SAPK-74602INBICONT |
| Release 707 All Support Package Levels |
------------------------------------------------------------------------
1. Install the notes 1694226 and 1611670 into your BW system.
2. In the Web Interface (SAPMCBW501), the value of property 'Use HTTPS' must be 'true' instead of 'false'.
Because Web Interface (SAPMCBW501) is locked by SAP, please apply the following BI Content support packages:
SAPK-70508INBICONT
SAPK-70605INBICONT
SAPK-73507INBICONT
SAPK-73603INBICONT
3. Follow the recommendation of note 733833 (paragraph "Web user interface:Modifications in the Web Interface") and create a copy of the SAPMCBW501 Web interface using transaction BSP_WB.
------------------------------------------------------------------------
|Manual Activity |
------------------------------------------------------------------------
|VALID FOR |
|Software Component BI_CONT Business Intell...|
| Release 705 SAPK-70501INBICONT - SAPK-70507INBICONT |
| Release 735 Until SAPK-73506INBICONT |
| Release 706 SAPK-70601INBICONT - SAPK-70604INBICONT |
| Release 736 SAPK-73601INBICONT - SAPK-73602INBICONT |
| Release 746 SAPK-74601INBICONT - SAPK-74602INBICONT |
| Release 707 All Support Package Levels |
------------------------------------------------------------------------
1. Install the notes 1694226 and 1611670 into your BW system.
2. In the Web Interface (SAPMCBW501), the value of property 'Use HTTPS' must be 'true' instead of 'false'.
Because Web Interface (SAPMCBW501) is locked by SAP, please apply the following BI Content support packages:
SAPK-70508INBICONT
SAPK-70605INBICONT
SAPK-73507INBICONT
SAPK-73603INBICONT
3. Follow the recommendation of note 733833 (paragraph "Web user interface:Modifications in the Web Interface") and create a copy of the SAPMCBW501 Web interface using transaction BSP_WB.
Ссылки
