Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:N/C:P/I:N/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1729293-3)
SAP Support Packages
(SAPKB64031, SAPKB70028, SAPKB70113, SAPKB70212, SAPKB71016, SAPKB71110, SAPKB72008, SAPKB73008, SAPKB73105)
Описание
The problem is caused by a program error in GRMG due to the incorrect use of an XML parser.By default, the parser opens external entities referenced within an XML input, which can then lead to malicious content being parsed.This malicious content can reference internal resources, such as files.These internal resources can be used to perform a denial of service attack on the parsing system, rending application content temporarily unavailable.
Как исправить
Implement the support package or the correction instruction. In the latter case the note 1594475 has to be implemented before, which means that the system has to be at least at the support package level described in the note 1594475.Please note that in release 6.20 there is no program correction available; you can indeed use the profile parameters as described in the note 1594475.
Ссылки
