Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:S/C:P/I:P/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1724623-3)
SAP Support Packages
(SAPK-40007INAIN, SAPK-51019INAIN, SAPK-70011INAIN, SAPK-71009INAIN)
Описание
AutoID Mobile application does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
Как исправить
Implement the attached correction instructions.------------------------------------------------------------------------|Manual Pre-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component AIN Auto-ID Infrast...|| Release 400 SAPK-40001INAIN - SAPK-40006INAIN || Release 510 SAPK-51001INAIN - SAPK-51018INAIN || Release 700 SAPK-70001INAIN - SAPK-70010INAIN |------------------------------------------------------------------------
1. Create a new Authorization Field
Start transaction 'SU20'
Hit 'Create' (Shift+F4)
Enter Field Name '/AIN/DEVGR'
Enter Data element '/AIN/DM_DEVGRP_ID'
Enter Table Name '/AIN/DM_DEVGRP'
Hit 'Save' (Ctrl+S)
If popup to select a Package is raised, enter package '/AIN/UI'
2. Create a new Authorization Object
Start transaction 'SU21'
Hit button 'Create' / 'Authorization Object'
Enter Object '/AIN/DEVGR'
Enter Text 'Authorisation to use Device Group'
Enter Class 'AIN'
Enter Authorization Field '/AIN/DEVGR'
Hit 'Save'
If popup to select a Package is raised, enter package '/AIN/UI'
3. Create a new Message
Start Transaction 'SE91'
Enter Message Class '/AIN/UI
Hit 'Change' (F6)
Select Message number '514'
Enter Message shortext 'Error: Device Group &1 is not authorized for user &2'
Tick Checkbox 'SelfExplanatory' = 'X'
Hit 'Save' (Ctrl+S)
4. Implement the default authorization values
Download the attached file 'SU22_mobile1.TXT' only
Follow the instruction given in related note '368496' with the downloaded file.
------------------------------------------------------------------------|Manual Pre-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component AIN Auto-ID Infrast...|| Release 710 SAPK-71003INAIN - SAPK-71008INAIN |------------------------------------------------------------------------
1. Create a new Authorization Field
Start transaction 'SU20'
Hit 'Create' (Shift+F4)
Enter Field Name '/AIN/DEVGR'
Enter Data element '/AIN/DM_DEVGRP_ID'
Enter Table Name '/AIN/DM_DEVGRP'
Hit 'Save' (Ctrl+S)
If popup to select a Package is raised, enter package '/AIN/UI'
2. Create a new Authorization Object
Start transaction 'SU21'
Hit button 'Create' / 'Authorization Object'
Enter Object '/AIN/DEVGR'
Enter Text 'Authorisation to use Device Group'
Enter Class 'AIN'
Enter Authorization Field '/AIN/DEVGR'
Hit 'Save'
If popup to select a Package is raised, enter package '/AIN/UI'
3. Create a new Message
Start Transaction 'SE91'
Enter Message Class '/AIN/UI
Hit 'Change' (F6)
Select Message number '514'
Enter Message shortext 'Error: Device Group &1 is not authorized for user &2'
Tick Checkbox 'SelfExplanatory' = 'X'
Hit 'Save' (Ctrl+S)
4. Implement the default authorization values
Download the attached files 'SU22_mobile1.TXT' and 'SU22_mobile2.TXT'
Follow the instruction given in related note '368496' with the 2 downloaded files.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component AIN Auto-ID Infrast...|| Release 400 SAPK-40001INAIN - SAPK-40006INAIN || Release 510 SAPK-51001INAIN - SAPK-51018INAIN || Release 700 SAPK-70001INAIN - SAPK-70010INAIN || Release 710 SAPK-71003INAIN - SAPK-71008INAIN |------------------------------------------------------------------------Each user of mobile transaction can now be explicitely authorized for a specific Device Group.As a role and profile administrator, you can configure the authorization object '/AIN/DEVGR' for each users of transactions /AIN/MOBILE1 (for releases starting with AIN 4.0) and /AIN/MOBILE2 for releases starting with AIN 7.1.
1. Create a new Authorization Field
Start transaction 'SU20'
Hit 'Create' (Shift+F4)
Enter Field Name '/AIN/DEVGR'
Enter Data element '/AIN/DM_DEVGRP_ID'
Enter Table Name '/AIN/DM_DEVGRP'
Hit 'Save' (Ctrl+S)
If popup to select a Package is raised, enter package '/AIN/UI'
2. Create a new Authorization Object
Start transaction 'SU21'
Hit button 'Create' / 'Authorization Object'
Enter Object '/AIN/DEVGR'
Enter Text 'Authorisation to use Device Group'
Enter Class 'AIN'
Enter Authorization Field '/AIN/DEVGR'
Hit 'Save'
If popup to select a Package is raised, enter package '/AIN/UI'
3. Create a new Message
Start Transaction 'SE91'
Enter Message Class '/AIN/UI
Hit 'Change' (F6)
Select Message number '514'
Enter Message shortext 'Error: Device Group &1 is not authorized for user &2'
Tick Checkbox 'SelfExplanatory' = 'X'
Hit 'Save' (Ctrl+S)
4. Implement the default authorization values
Download the attached file 'SU22_mobile1.TXT' only
Follow the instruction given in related note '368496' with the downloaded file.
------------------------------------------------------------------------|Manual Pre-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component AIN Auto-ID Infrast...|| Release 710 SAPK-71003INAIN - SAPK-71008INAIN |------------------------------------------------------------------------
1. Create a new Authorization Field
Start transaction 'SU20'
Hit 'Create' (Shift+F4)
Enter Field Name '/AIN/DEVGR'
Enter Data element '/AIN/DM_DEVGRP_ID'
Enter Table Name '/AIN/DM_DEVGRP'
Hit 'Save' (Ctrl+S)
If popup to select a Package is raised, enter package '/AIN/UI'
2. Create a new Authorization Object
Start transaction 'SU21'
Hit button 'Create' / 'Authorization Object'
Enter Object '/AIN/DEVGR'
Enter Text 'Authorisation to use Device Group'
Enter Class 'AIN'
Enter Authorization Field '/AIN/DEVGR'
Hit 'Save'
If popup to select a Package is raised, enter package '/AIN/UI'
3. Create a new Message
Start Transaction 'SE91'
Enter Message Class '/AIN/UI
Hit 'Change' (F6)
Select Message number '514'
Enter Message shortext 'Error: Device Group &1 is not authorized for user &2'
Tick Checkbox 'SelfExplanatory' = 'X'
Hit 'Save' (Ctrl+S)
4. Implement the default authorization values
Download the attached files 'SU22_mobile1.TXT' and 'SU22_mobile2.TXT'
Follow the instruction given in related note '368496' with the 2 downloaded files.
------------------------------------------------------------------------|Manual Post-Implement. |------------------------------------------------------------------------|VALID FOR ||Software Component AIN Auto-ID Infrast...|| Release 400 SAPK-40001INAIN - SAPK-40006INAIN || Release 510 SAPK-51001INAIN - SAPK-51018INAIN || Release 700 SAPK-70001INAIN - SAPK-70010INAIN || Release 710 SAPK-71003INAIN - SAPK-71008INAIN |------------------------------------------------------------------------Each user of mobile transaction can now be explicitely authorized for a specific Device Group.As a role and profile administrator, you can configure the authorization object '/AIN/DEVGR' for each users of transactions /AIN/MOBILE1 (for releases starting with AIN 4.0) and /AIN/MOBILE2 for releases starting with AIN 7.1.
Ссылки
