Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1655538-2)
SAP Support Packages
(SAPK-60445INSAPHRCJP)
Описание
ITS Services (TS_WS01200170H, WS01000060) do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting issue.
Cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user.
If an administrator is impersonated, the security of the application may be fully compromised.
Cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user.
If an administrator is impersonated, the security of the application may be fully compromised.
Как исправить
The corrections in this note are only for security enhancement and do not change any current functionality.
The corrections of this note do only have an protecting effect if the corrections of notes 1621946 and 1488500 are implemented.
If you need the security enhancement, you may apply the changes via the relevant support package or follow the maual steps below:
1. Login on the system and goto Maintain Services(use the "sicf" tcode).
Input the service name "TS_WS01200170H " and execute the program.
2. Double click the "TS_WS01200170H" service on the below list.
3. Change the "TS_WS01200170H" service and click the "GUI Configuraton" button.
4. Add the two parameters as following if they do not excit
Parameter Name Value
~auto_html_escaping 1
~new_xss_functions 1
5. Do the same correction for the "WS01000060" service.
The corrections of this note do only have an protecting effect if the corrections of notes 1621946 and 1488500 are implemented.
If you need the security enhancement, you may apply the changes via the relevant support package or follow the maual steps below:
1. Login on the system and goto Maintain Services(use the "sicf" tcode).
Input the service name "TS_WS01200170H " and execute the program.
2. Double click the "TS_WS01200170H" service on the below list.
3. Change the "TS_WS01200170H" service and click the "GUI Configuraton" button.
4. Add the two parameters as following if they do not excit
Parameter Name Value
~auto_html_escaping 1
~new_xss_functions 1
5. Do the same correction for the "WS01000060" service.
Ссылки
