Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:S/C:P/I:P/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1831053-2)
SAP Support Packages
(LIFECYCLE_MGMT_TOOLS_701_SP014_000000, LIFECYCLE_MGMT_TOOLS_701_SP999999_999999, LIFECYCLE_MGMT_TOOLS_702_SP014_000000, LIFECYCLE_MGMT_TOOLS_702_SP999999_999999, LM_CTS_720_SP009_000001, LM_CTS_720_SP999999_999999, LM_CTS_730_SP010_000000, LM_CTS_730_SP999999_999999, LM_CTS_731_SP008_000000, LM_CTS_731_SP999999_999999, LM_CTS_740_SP003_000000, LM_CTS_740_SP999999_999999)
Описание
CM Services (BC-CTS-CMS) does not contain authorization checks for checking an authenticated user's authorization to access some of its functions. This may result in undesired system behavior.
Как исправить
Coding gets completed by authorization checks when applying one of the following Support Package Stacks:7.01 SP 14 (Software Component LM-TOOLS)7.02 SP 14 (Software Component LM-TOOLS)7.30 SP 10 (Software Component LM-CTS)7.31 SP 8 (Software Component LM-CTS)7.40 SP 3 (Software Component LM-CTS)In 7.20 there are no further SP Stacks delivered. The change is contained in SP 9 Patch 1 (Software Component LM-CTS)In case you use SAP delivered UME roles to operate your NWDI no further steps are required. (e.g.: SAP_DI_ADMINISTRATOR, SAP_DI_DEVELOPER or in some releases NWDI.Administrator, NWDI.Developer)If you created your own UME roles to operate NWDI you need to adapt them and assign new actions to them. For details see help.sap.com of your AS Java Release - "Authorizations in CM Services".
Ссылки
