Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1772839-2)
SAP Support Packages
(SAPKB46C65, SAPKB62073, SAPKB62074, SAPKB64031, SAPKB64032, SAPKB70028, SAPKB70029, SAPKB70113, SAPKB70114, SAPKB70213, SAPKB71016, SAPKB71017, SAPKB71111, SAPKB72008, SAPKB73009, SAPKB73106, SAPKB73107, SAPKB74001)
Описание
The problem is caused by an SQL injection vulnerability. The code composes an SQL statement that contains strings that can be altered by an attacker. The manipulated SQL statement can then be used to retrieve data from the database.
Как исправить
Implement the code corrections in this note------------------------------------------------------------------------|Manual Pre-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component SAP_BASIS SAP Basis compo...|| Release 46C Until SAPKB46C64 || Release 620 Until SAPKB62072 || Release 640 Until SAPKB64030 || Release 700 SAPKB70004 - SAPKB70027 || Release 710 Until SAPKB71015 || Release 711 SAPKB71101 - SAPKB71110 || Release 701 Until SAPKB70112 || Release 702 SAPKB70201 - SAPKB70212 || Release 730 SAPKB73001 - SAPKB73008 || Release 720 SAPKB72002 - SAPKB72007 || Release 731 SAPKB73101 - SAPKB73105 || Release 740 w/o Support Packages |------------------------------------------------------------------------You need to follow these manual steps that are mentioned below:Creation of AM 560 message.1. Go to transaction 'SE91'.2. Enter the message class as 'AM' and choose subobjects as 'messages'.3. Now enter '560' in number field and click on 'change'.4. Here you need to maintain the text in 'English' (If the log on language is English) "Entry is Invalid".5. The text in German language is "Eintrag ist nicht giltig".Use this text if you are maintaining the data either in the 'original language' or if your logon language is 'German'.6. Save and activate the changes made.
Ссылки
