Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:S/C:P/I:P/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1831022-2)
SAP Support Packages
(DI_CHANGE_MGMT_SERVER__701_SP014_000000, DI_CHANGE_MGMT_SERVER__701_SP999999_999999, DI_CHANGE_MGMT_SERVER__702_SP014_000000, DI_CHANGE_MGMT_SERVER__702_SP999999_999999, DI_CHANGE_MGMT_SERVER__740_SP003_000000, DI_CHANGE_MGMT_SERVER__740_SP999999_999999, DI_CHANGE_MGMT_SERVER_700_SP029_000000, DI_CHANGE_MGMT_SERVER_700_SP999999_999999, DI_CHANGE_MGMT_SERVER_710_SP018_000000, DI_CHANGE_MGMT_SERVER_710_SP999999_999999, DI_CHANGE_MGMT_SERVER_711_SP013_000000, DI_CHANGE_MGMT_SERVER_711_SP999999_999999, DI_CHANGE_MGMT_SERVER_720_SP009_000001, DI_CHANGE_MGMT_SERVER_720_SP999999_999999, DI_CHANGE_MGMT_SERVER_730_SP010_000000, DI_CHANGE_MGMT_SERVER_730_SP999999_999999, DI_CHANGE_MGMT_SERVER_731_SP008_000000, DI_CHANGE_MGMT_SERVER_731_SP999999_999999)
Описание
DI_CMS (BC-CTS-CMS) does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
Как исправить
Coding gets completed by authorization checks when applying one of thefollowing Support Package Stacks for software component DI_CMS:7.00 SP 297.01 SP 147.02 SP 147.11 SP 137.30 SP 107.31 SP 87.40 SP 3In 7.20 there are no further SP Stacks delivered. The change is contained in SP 9 Patch 1.In case you use SAP delivered UME roles to operate your NWDI no further steps are required. (e.g.: SAP_DI_ADMINISTRATOR, SAP_DI_DEVELOPER or in some releases NWDI.Administrator, NWDI.Developer)If you created your own UME roles to operate NWDI you need to adapt them and assign new actions to them. For details see help.sap.com of your AS Java Release - "Authorizations in Change Management Service" and "Roles in the Change Management Service".
Ссылки
