Description
- You want to disable default servlet mapping “/servlet/*”
- Servlets can be accessed via a different path anonymously regardless of security constraints defined in the web.xml. Servlets that are not declared in the web.xml at all can also be accessed successfully.
Available fix and Supported packages
- ENGINEAPI | 7.10 | 7.11
- ENGINEAPI | 7.20 | 7.20
- EP-PSERV | 6.0_640 | 6.0_640
- EP-BASIS | 7.10 | 7.11
- EP-BASIS | 7.20 | 7.20
- EP-BASIS | 7.30 | 7.30
- SAP-JEECOR | 7.00 | 7.00
- SAP-JEECOR | 6.40 | 6.40
- SAP-JEECOR | 7.01 | 7.02
- SERVERCORE | 7.10 | 7.10
- SERVERCORE | 7.11 | 7.11
- SERVERCORE | 7.20 | 7.20
- EPBC | 7.00 | 7.02
- ENGINEAPI 7.10 | SP009 | 000006
- ENGINEAPI 7.10 | SP010 | 000004
- ENGINEAPI 7.10 | SP011 | 000000
- ENGINEAPI 7.10 | SP012 | 000000
- ENGINEAPI 7.11 | SP003 | 000008
- ENGINEAPI 7.11 | SP004 | 000009
- ENGINEAPI 7.11 | SP005 | 000005
- ENGINEAPI 7.11 | SP006 | 000000
- ENGINEAPI 7.11 | SP007 | 000000
- ENGINEAPI 7.20 | SP001 | 000005
- ENGINEAPI 7.20 | SP002 | 000007
- ENGINEAPI 7.20 | SP003 | 000003
- ENGINEAPI 7.20 | SP004 | 000000
- J2EE ENGINE SERVERCORE 7.10 | SP009 | 000019
- J2EE ENGINE SERVERCORE 7.10 | SP010 | 000012
- J2EE ENGINE SERVERCORE 7.10 | SP011 | 000000
- J2EE ENGINE SERVERCORE 7.11 | SP003 | 000022
- J2EE ENGINE SERVERCORE 7.11 | SP004 | 000017
- J2EE ENGINE SERVERCORE 7.11 | SP005 | 000010
- J2EE ENGINE SERVERCORE 7.11 | SP006 | 000000
Affected component
- BC-JAS-WEB
Web Container, HTTP, JavaMail, Servlets
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1445998
