Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1684640-1)
SAP Support Packages
(616, SAPK-60022INISM, SAPK-60212INISM, SAPK-60311INISM, SAPK-60412INISM, SAPK-60509INISM, SAPK-60603INISM, SAPKIPPM29, SAPKIPPN23)
Описание
Some BSP Page within IS-M do not sufficiently encode OUTPUT parameters, resulting in a possible cross-site scripting issue.Cross-site scripting can be used to steal another user's authentication information, such as data relating to their current session. A malicious user who gains access to this data may use it to impersonate the user and access all information with the same rights as the target user.If an administrator is impersonated, the security of the application may be fully compromised.
Как исправить
Please apply this note or import the changes via the relevant supportpackage.The changes that come with this correction will include a switch of the HTMLB-design for the following applications.
ISMCAMPAIGNPICK
ISMSD_SOCREATE
ISMCAMPAIGNMGNT
The design defines how the application is rendered. If the application was rendered with CLASSIC or DESIGN2002 then it will now use DESIGN2008. There will be no impact on the functionality of your application. Switching to the new design is necessary due to compatibility reasons that were not fulfilled by CLASSIC and DESIGN2002.This new design was already introduced for these BSPs with note 1040672. In ISM602 this new design could be used with a modification, in ISM603 and ISM604 it could be used when switching on Business Functions MED_MSD_1 or MED_MAM_1. With the correction of this note the possibility to switch between the old and new design is no longer possible. Only the new designs DESIGN2003 and DESIGN2008 are available.
ISMCAMPAIGNPICK
ISMSD_SOCREATE
ISMCAMPAIGNMGNT
The design defines how the application is rendered. If the application was rendered with CLASSIC or DESIGN2002 then it will now use DESIGN2008. There will be no impact on the functionality of your application. Switching to the new design is necessary due to compatibility reasons that were not fulfilled by CLASSIC and DESIGN2002.This new design was already introduced for these BSPs with note 1040672. In ISM602 this new design could be used with a modification, in ISM603 and ISM604 it could be used when switching on Business Functions MED_MSD_1 or MED_MAM_1. With the correction of this note the possibility to switch between the old and new design is no longer possible. Only the new designs DESIGN2003 and DESIGN2008 are available.
Ссылки
