Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:S/C:N/I:N/A:PThis)
Производитель ПО
Наименование ПО
SAP Notes
(1553180-5)
SAP Support Packages
(SAP_KERNEL_46D_EX2_32_BIT_SP618_002618, SAP_KERNEL_46D_EX2_32_BIT_SP999999_999999, SAP_KERNEL_46D_EX2_64_BIT_SP618_002618, SAP_KERNEL_46D_EX2_64_BIT_SP999999_999999, SAP_KERNEL_46D_EXT_32_BIT_SP618_002618, SAP_KERNEL_46D_EXT_32_BIT_SP999999_999999, SAP_KERNEL_46D_EXT_64_BIT_SP618_002618, SAP_KERNEL_46D_EXT_64_BIT_SP999999_999999, SAP_KERNEL_640_32_BIT_SP394_000394, SAP_KERNEL_640_32_BIT_SP999999_999999, SAP_KERNEL_640_32_BIT_UNICODE_SP394_000394, SAP_KERNEL_640_32_BIT_UNICODE_SP999999_999999, SAP_KERNEL_640_64_BIT_SP394_000394, SAP_KERNEL_640_64_BIT_SP999999_999999, SAP_KERNEL_640_64_BIT_UNICODE_SP394_000394, SAP_KERNEL_640_64_BIT_UNICODE_SP999999_999999, SAP_KERNEL_640_EX2_32_BIT_SP394_000394, SAP_KERNEL_640_EX2_32_BIT_SP999999_999999, SAP_KERNEL_640_EX2_32_BIT_UC_SP394_000394, SAP_KERNEL_640_EX2_32_BIT_UC_SP999999_999999, SAP_KERNEL_640_EX2_64_BIT_SP394_000394, SAP_KERNEL_640_EX2_64_BIT_SP999999_999999, SAP_KERNEL_640_EX2_64_BIT_UC_SP394_000394, SAP_KERNEL_640_EX2_64_BIT_UC_SP999999_999999, SAP_KERNEL_700_32_BIT_SP333_000333, SAP_KERNEL_700_32_BIT_SP999999_999999, SAP_KERNEL_700_32_BIT_UNICODE_SP333_000333, SAP_KERNEL_700_32_BIT_UNICODE_SP999999_999999, SAP_KERNEL_700_64_BIT_SP333_000333, SAP_KERNEL_700_64_BIT_SP999999_999999, SAP_KERNEL_700_64_BIT_UNICODE_SP333_000333, SAP_KERNEL_700_64_BIT_UNICODE_SP999999_999999, SAP_KERNEL_701_32_BIT_SP175_000175, SAP_KERNEL_701_32_BIT_SP999999_999999, SAP_KERNEL_701_32_BIT_UNICODE_SP175_000175, SAP_KERNEL_701_32_BIT_UNICODE_SP999999_999999, SAP_KERNEL_701_64_BIT_SP175_000175, SAP_KERNEL_701_64_BIT_SP999999_999999, SAP_KERNEL_701_64_BIT_UNICODE_SP175_000175, SAP_KERNEL_701_64_BIT_UNICODE_SP999999_999999, SAP_KERNEL_710_32_BIT_SP264_000264, SAP_KERNEL_710_32_BIT_SP999999_999999, SAP_KERNEL_710_32_BIT_UNICODE_SP264_000264, SAP_KERNEL_710_32_BIT_UNICODE_SP999999_999999, SAP_KERNEL_710_64_BIT_SP264_000264, SAP_KERNEL_710_64_BIT_SP999999_999999, SAP_KERNEL_710_64_BIT_UNICODE_SP264_000264, SAP_KERNEL_710_64_BIT_UNICODE_SP999999_999999, SAP_KERNEL_711_32_BIT_SP151_000151, SAP_KERNEL_711_32_BIT_SP999999_999999, SAP_KERNEL_711_32_BIT_UNICODE_SP151_000151, SAP_KERNEL_711_32_BIT_UNICODE_SP999999_999999, SAP_KERNEL_711_64_BIT_SP151_000151, SAP_KERNEL_711_64_BIT_SP999999_999999, SAP_KERNEL_711_64_BIT_UNICODE_SP151_000151, SAP_KERNEL_711_64_BIT_UNICODE_SP999999_999999, SAP_KERNEL_720_32_BIT_SP118_000118, SAP_KERNEL_720_32_BIT_SP999999_999999, SAP_KERNEL_720_32_BIT_UNICODE_SP118_000118, SAP_KERNEL_720_32_BIT_UNICODE_SP999999_999999, SAP_KERNEL_720_64_BIT_SP118_000118, SAP_KERNEL_720_64_BIT_SP999999_999999, SAP_KERNEL_720_64_BIT_UNICODE_SP118_000118, SAP_KERNEL_720_64_BIT_UNICODE_SP999999_999999, SAPKB46B62, SAPKB46C64, SAPKB46D45, SAPKB61048, SAPKB62072, SAPKB64030, SAPKB70027, SAPKB70111, SAPKB70211, SAPKB71014, SAPKB71109, SAPKB72007, SAPKB73007, SAPKB73103)
Описание
SAP systems do not contain authorization checks for checking an authenticated user's authorization to access some of their functions. Without these checks, an authenticated user can call these functions without this being the desired system behavior.
Как исправить
Implement the attached correction instructions. In addition, you must set the undocumented profile parameter rdisp/th_popup/strict_check = 1. The authorization check is executed for the authorization object S_ADMI_FCD from the class BC_A. In transaction SE12, you must manually create a new entry for the domain XUFUNCTION in the value range with the value POPU and the short description TH_POPUP. The authorization is required if you want to display a dialog box for a different user.The problem is solved as of the listed Support Packages.------------------------------------------------------------------------|Manual Pre-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_BASIS SAP Basis compo...|| Release 46D Until SAPKB46D44 || Release 620 Until SAPKB62071 || Release 640 Until SAPKB64029 || Release 700 SAPKB70004 - SAPKB70026 || Release 710 Until SAPKB71013 || Release 711 SAPKB71101 - SAPKB71108 || Release 701 Until SAPKB70110 || Release 702 SAPKB70201 - SAPKB70210 || Release 730 SAPKB73001 - SAPKB73006 || Release 720 SAPKB72002 - SAPKB72006 || Release 731 SAPKB73101 - SAPKB73102 |------------------------------------------------------------------------Change the domain XUFUNCTION manually using transaction SE11:Choose "Change", switch to the "Value Range" tab page and go to "Single Vals".Enter the following new fixed value:Fix.Val.: POPUShort Description: TH_POPUPAfter this, activate the domain XUFUNCTION.------------------------------------------------------------------------|Manual Pre-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_BASIS SAP Basis compo...|| Release 610 Until SAPKB61047 || Release 46C Until SAPKB46C63 || Release 46B Until SAPKB46B61 |------------------------------------------------------------------------Change the domain XUFUNCTION manually using transaction SE11:Choose "Change", switch to the "Value Range" tab page and go to "Single Vals".Enter the following new fixed value:Fix.Val.: POPUShort Descript.: TH_POPUPAfter this, activate the domain XUFUNCTION.
Ссылки
