Description
- An attacker can remotely exploit the Web container (servlet_jsp), rendering it, and potentially the resources that are used to serve AS Java (J2EE), unavailable.
- After an HTTP request, one of the following errors is observed:
There are too many parameters in the request. Maximum number of parameters in the request 1000 was exceeded. Check SAP note 1678387 for further information.
Cannot parse the parameters of the request. Maximum number of parameters 5000 was exceeded.
Available fix and Supported packages
- ENGINEAPI | 7.10 | 7.11
- ENGINEAPI | 7.20 | 7.20
- ENGINEAPI | 7.30 | 7.30
- ENGINEAPI | 7.31 | 7.31
- SAP-JEECOR | 7.00 | 7.00
- SAP-JEECOR | 6.40 | 6.40
- SAP-JEECOR | 7.01 | 7.02
- ENGINEAPI 7.10 | SP012 | 000010
- ENGINEAPI 7.10 | SP013 | 000007
- ENGINEAPI 7.10 | SP014 | 000005
- ENGINEAPI 7.10 | SP015 | 000000
- ENGINEAPI 7.10 | SP016 | 000000
- ENGINEAPI 7.11 | SP006 | 000014
- ENGINEAPI 7.11 | SP007 | 000013
- ENGINEAPI 7.11 | SP008 | 000010
- ENGINEAPI 7.11 | SP009 | 000008
- ENGINEAPI 7.11 | SP010 | 000000
- ENGINEAPI 7.11 | SP011 | 000000
- ENGINEAPI 7.20 | SP004 | 000017
- ENGINEAPI 7.20 | SP005 | 000012
- ENGINEAPI 7.20 | SP006 | 000008
- ENGINEAPI 7.20 | SP007 | 000004
- ENGINEAPI 7.20 | SP008 | 000000
- ENGINEAPI 7.30 | SP002 | 000007
- ENGINEAPI 7.30 | SP003 | 000015
- ENGINEAPI 7.30 | SP004 | 000011
- ENGINEAPI 7.30 | SP005 | 000011
Affected component
- BC-JAS-WEB
Web Container, HTTP, JavaMail, Servlets
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1678387
