Missing input validation in WebDynpro Application, SAP security note 1424863

SAP security note 1424863, "Missing Input Validation in WebDynpro Application", is a note released on 11.02.2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Missing input validation in WebDynpro Application.

Solution

This issue has been fixed in WebDynpro Runtime. The details of the fix are described in SAP note 1049391. The solution is available in the following support packages:

• NW04, SP21 and above.
• NW04S, SP13 and above.

Note: Higher releases of WebDynpro are not affected as they already contain the solution.

Downloading WebDynpro for Java Patches: All WebDynpro for Java patches are available on SAP Service Marketplace. Note 330793 explains how to download patches from SAP Service Marketplace.

Update your system via JSPM: Please refer to the official JSPM documentation.

Release Specific:

• NW04 / NW 6.40: The patch for this release will be in SAR file. Extract them to get SDA’s. Further SDA’s can be deployed using JSPM.
• NW04S / NW 7.00: The patch for this release will be SCAs. Deploy the SCAs directly using JSPM.

Reason and prerequisites

Missing input validation in WebDynpro Application.

CVSS

Score 0

References

• 1049391 – Definition of whitelist for allowed hosts for theme URLs

Affected components

• SAP-JEE: 6.40
• SAP_JTECHS: 7.00
• SAP_JTECHF: 7.00