Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1874456-5)
SAP Support Packages
(SAPKU50023, SAPKU60014, SAPKU70014, SAPKU70111, SAPKU70209, SAPKU71204, SAPKU71302)
Описание
CRM-BF-IIA fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, an attacker can potentially direct the program to an other file in the system, disclosing its contents.
Как исправить
Refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.Logical File Names Used in this SolutionThe following logical file names have been created in order to enable the validation of physical file names:Logical File Name Definition SDB_ATTACHMENT_LFNLogical file SDB_ATTACHMENT_LFNName CRM_ATTACHMENT_UPLOAD_LFNPhysical fileData format DIRApplicat.areaLogical path /SDB/ATTACHMENTand Logical File Path Definition /SDB/ATTACHMENT with NAME CRM_ATTACHMENT_UPLOAD------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component BBPCRM BBP / CRM || Release 500 Until SAPKU50022 || Release 700 SAPKU70001 - SAPKU70013 || Release 600 SAPKU60001 - SAPKU60013 || Release 701 SAPKU70103 - SAPKU70110 || Release 702 SAPKU70201 - SAPKU70208 || Release 713 Until SAPKU71301 || Release 712 Until SAPKU71203 |------------------------------------------------------------------------Configure Logical File Name for new security functionalityTo configure LFN, go to transaction FILE and maintainLogical File Name Definition SDB_ATTACHMENT_LFNLogical file SDB_ATTACHMENT_LFNName CRM_ATTACHMENT_UPLOAD_LFNPhysical fileData format DIRApplicat.areaLogical path /SDB/ATTACHMENTand Logical File Path Definition /SDB/ATTACHMENTwith NAME CRM_ATTACHMENT_UPLOAD
Ссылки
