Note 1677475 - Unauthorized use of application functions in HRRCF_START_EXT

Уровень опасности

Низкая (0.0)

Оценка CVSS

Производитель ПО

SAP

Наименование ПО

SAP Notes (1677475-2) SAP Support Packages (616, 617, SAPK-30026INERECRUIT, SAPK-60022INERECRUIT, SAPK-60311INERECRUIT, SAPK-60412INERECRUIT, SAPK-60509INERECRUIT, SAPK-60604INERECRUIT, SAPK-60605INERECRUIT, SAPK-60608INERECRUIT, SAPK-61603INERECRUIT, SAPK-61701INERECRUIT)

Описание

HRRCF_START_EXT executes certain functions by referencing specific URLs. When an attacker tricks an authenticated user's browser into making a request containing a certain URL and specific parameters, the function is executed with the rights of the authenticated user.The attacker may use a cross-site scripting attack to do this, or they may present a link to the victim.

Как исправить

Apply the latest support package for fixing this issue. Make sure you have the applied OSS notes 1509014,1520324 and 1551982 before applying this note.

Ссылки

Назад к списку уязвимостей

Note 1677475 - Unauthorized use of application functions in HRRCF_START_EXT

Карточка уязвимости

Характеристики уязвимости