Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1628849-5)
SAP Support Packages
(746, SAPK-52013INCRMUIF, SAPK-60015INCRMUIF, SAPK-70012INWEBCUIF, SAPK-70109INWEBCUIF, SAPK-73004INWEBCUIF, SAPK-73102INWEBCUIF, SAPK-73103INWEBCUIF, SAPK-73104INWEBCUIF)
Описание
WEBCUIF results in a stored cross-site scripting issue.It can be used to permanently modify displayed content from a Web site, allowing the attacker to embed content that is rendered automatically, without the attacker having to target victims individually.Stored cross-site scripting can also be used to steal another user's authentication information, such as data relating to their current session.An attacker who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user. If an administrator is impersonated, the security of the application may be fully compromised.
Как исправить
Please install the correspondig support package or implement the correction instructions and follow the manual steps.------------------------------------------------------------------------|Manual Pre-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 731 SAPK-73101INWEBCUIF - SAPK-73102INWEBCUIF |------------------------------------------------------------------------OTR TextsFollow the steps in order to add new OTR text for your language:
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component CRMUIF SAP CRM UIF || Release 600 SAPK-60007INCRMUIF - SAPK-60014INCRMUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component CRMUIF SAP CRM UIF || Release 520 SAPK-52003INCRMUIF - SAPK-52012INCRMUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 731 SAPK-73101INWEBCUIF - SAPK-73103INWEBCUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 701 SAPK-70103INWEBCUIF - SAPK-70108INWEBCUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 700 SAPK-70006INWEBCUIF - SAPK-70011INWEBCUIF || Release 730 Until SAPK-73003INWEBCUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component CRMUIF SAP CRM UIF || Release 600 SAPK-60007INCRMUIF - SAPK-60014INCRMUIF |------------------------------------------------------------------------OTR TextsFollow the steps in order to add new OTR text for your language:
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 700 SAPK-70006INWEBCUIF - SAPK-70011INWEBCUIF || Release 730 Until SAPK-73003INWEBCUIF |------------------------------------------------------------------------OTR TextsFollow the steps in order to add new OTR text for your language:
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 701 SAPK-70103INWEBCUIF - SAPK-70108INWEBCUIF |------------------------------------------------------------------------OTR TextsFollow the steps in order to add new OTR text for your language:
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component CRMUIF SAP CRM UIF || Release 600 SAPK-60007INCRMUIF - SAPK-60014INCRMUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component CRMUIF SAP CRM UIF || Release 520 SAPK-52003INCRMUIF - SAPK-52012INCRMUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 731 SAPK-73101INWEBCUIF - SAPK-73103INWEBCUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 701 SAPK-70103INWEBCUIF - SAPK-70108INWEBCUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 700 SAPK-70006INWEBCUIF - SAPK-70011INWEBCUIF || Release 730 Until SAPK-73003INWEBCUIF |------------------------------------------------------------------------After successfully implementing the correction instructions the new report WCF_BSP_SET_VALIDATION will be availbale. This report will do some modifications to the BSP extensions used by the WebClient UI framework.To execute this report:
Open transaction SE38.
Enter report name WCF_BSP_SET_VALIDATION.
Press the 'Execute' button.
------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component CRMUIF SAP CRM UIF || Release 600 SAPK-60007INCRMUIF - SAPK-60014INCRMUIF |------------------------------------------------------------------------OTR TextsFollow the steps in order to add new OTR text for your language:
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 700 SAPK-70006INWEBCUIF - SAPK-70011INWEBCUIF || Release 730 Until SAPK-73003INWEBCUIF |------------------------------------------------------------------------OTR TextsFollow the steps in order to add new OTR text for your language:
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component WEBCUIF || Release 701 SAPK-70103INWEBCUIF - SAPK-70108INWEBCUIF |------------------------------------------------------------------------OTR TextsFollow the steps in order to add new OTR text for your language:
Open transaction se38
Execute Report: BTFR_CREATE_ALIAS_FOR_CONCEPT
Enter the following values:
- Original Language: Enter the relevant language - Package: CRM_BSP_UI_FRAME_PORTAL - Alias: CRM_BSP_UI_FRAME_PORTAL/URL - Object Type: WAPP - Concept: DA8A234F7492FF25E10000000A4286B5 - Length: 70 - Text: Portal URL is not valid (in English)
Execute the report to save
Ссылки
