Caching KM Content in the Portal, SAP security note 2158791

SAP security note 2158791, "Caching KM Content in the Portal", released on 11.07.2017. Below are the symptom and SAP recommended solution.

Description

Symptom

Temporary downloaded files accessed via a browser and stored in Knowledge Management (KM) are not cleared automatically. For example, when using Internet Explorer to open a document stored in KM, the browser downloads the document to your PC’s ‘Temporary Internet Files’ folder. After closing the document, its content remains in the ‘Temporary Internet Files’ folder.

This behavior might lead to unauthorized access to a document if the browser’s temporary downloaded files are not cleared. By default, the ‘Temporary Internet Files’ folder of Internet Explorer is a hidden folder under the ‘User’ directory, accessible only by the user who opened the file. However, this vulnerability might be exploited if the session of the user is active.

Solution

Perform the following steps separately on each system into which you transport the note.

• Navigate to System Administration > System Configuration > Knowledge Management > Content Management > Protocols (Advanced Option) > WebDAV protocol.
• Uncheck the Force File Caching attribute to allow browsers to skip file caching and downloading.