Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1875158-4)
SAP Support Packages
(SAPKU50023, SAPKU60014, SAPKU70014, SAPKU70111, SAPKU70209, SAPKU71204, SAPKU71302)
Описание
CRM-MD-SDB fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, an attacker can potentially direct the program to an arbitrary other file in the system, disclosing its contents.
Как исправить
Refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.Logical File Names Used in this SolutionThe following logical file names have been created in order to enable the validation of physical file names:Logical File Name Definition SDB_CMS_ATTACHMENT_LFNLogical file SDB_CMS_ATTACHMENT_LFNName SDB Content Management Service UploadPhysical fileData format DIRApplicat.areaLogical path /SDB/CMSATTACHMENTand Logical File Path Definition /SDB/CMSATTACHMENT with NAME Content Management SDB Upload------------------------------------------------------------------------|Manual Activity |------------------------------------------------------------------------|VALID FOR ||Software Component BBPCRM BBP / CRM || Release 500 Until SAPKU50022 || Release 700 SAPKU70001 - SAPKU70013 || Release 600 SAPKU60001 - SAPKU60013 || Release 701 SAPKU70103 - SAPKU70110 || Release 702 SAPKU70201 - SAPKU70208 || Release 713 Until SAPKU71301 || Release 712 Until SAPKU71203 |------------------------------------------------------------------------Configure Logical File Name for new security functionalityTo configure LFN, go to transaction FILE and maintainLogical File Name Definition SDB_CMS_ATTACHMENT_LFNLogical file SDB_CMS_ATTACHMENT_LFNName SDB Content Management Service UploadPhysical fileData format DIRApplicat.areaLogical path /SDB/CMSATTACHMENTand Logical File Path Definition /SDB/CMSATTACHMENTwith NAME Content Management SDB Upload
Ссылки
