Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:N/C:P/I:N/A:N)
Производитель ПО
Наименование ПО
SAP Notes
(1341333-5)
Описание
Information such as the user passwords can be discovered using sapdbctrl. This information may be used by an attacker to further target sapdbctrl.
The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is not required. Depending on the code, the user can:
" inject and run their own code,
" obtain additional information that should not be displayed,
" modify data, delete data,
" modify the output of the system,
" create new users with higher privileges,
" perform a denial-of-service attack.
The program code contains a possibility to define and execute user-defined code that changes the behavior of the system. A valid and authenticated user is not required. Depending on the code, the user can:
" inject and run their own code,
" obtain additional information that should not be displayed,
" modify data, delete data,
" modify the output of the system,
" create new users with higher privileges,
" perform a denial-of-service attack.
Как исправить
Apply the latest SAPHOSTagent patch with at least the patch level specified on SAP Service Marketplace.
This SAP Note was published originally as a functional SAP Note. If you have already implemented this SAP Note, you do not have to do anything else.
This SAP Note was published originally as a functional SAP Note. If you have already implemented this SAP Note, you do not have to do anything else.
Ссылки
