Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1675484-2)
SAP Support Packages
(712, SAPKU52011, SAPKU60012, SAPKU70012, SAPKU70109, SAPKU70203, SAPKU70204)
Описание
BSP Pages
CRMCMP_IC_FRAME BROADCAST_POPUP.HTM
CRMCMP_IC_FRAME CRMCMP_IC_FRAME_DEBUG_PAGE.HTM
CRMCMP_IC_FRAME DEBUG_PAGE.HTM
CRMCMP_IC_FRAME MCMAIN_HEADER.HTM
CRMCMP_IC_FRAME SCRATCHPAD.HTM
CRM_IC_WS_TEST ICWebServiceTest.htm
within CRM-IC do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting issue.Cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user.If an administrator is impersonated, the security of the application may be fully compromised.
CRMCMP_IC_FRAME BROADCAST_POPUP.HTM
CRMCMP_IC_FRAME CRMCMP_IC_FRAME_DEBUG_PAGE.HTM
CRMCMP_IC_FRAME DEBUG_PAGE.HTM
CRMCMP_IC_FRAME MCMAIN_HEADER.HTM
CRMCMP_IC_FRAME SCRATCHPAD.HTM
CRM_IC_WS_TEST ICWebServiceTest.htm
within CRM-IC do not sufficiently encode OUTPUT parameters, resulting in a cross-site scripting issue.Cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user.If an administrator is impersonated, the security of the application may be fully compromised.
Как исправить
Please apply this note or import the changes via the relevant support package.------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component BBPCRM BBP / CRM || Release 520 Until SAPKU52010 || Release 700 SAPKU70001 - SAPKU70011 || Release 600 SAPKU60001 - SAPKU60011 || Release 701 SAPKU70103 - SAPKU70108 || Release 702 SAPKU70201 - SAPKU70202 |------------------------------------------------------------------------The BSP application CRM_IC_WS_TEST and its SICF service have to be deleted.
1. Start transaction SE80
a) Select BSP Application CRM_IC_WS_TEST.
b) Delete this BSP application.
2. Start transaction SICF
a) Open service CRM_IC_WS_TEST (Hierarchy Type SERVICE, Service Name CRM_IC_WS_TEST).
b) Delete this service.
1. Start transaction SE80
a) Select BSP Application CRM_IC_WS_TEST.
b) Delete this BSP application.
2. Start transaction SICF
a) Open service CRM_IC_WS_TEST (Hierarchy Type SERVICE, Service Name CRM_IC_WS_TEST).
b) Delete this service.
Ссылки
