ABAP Vulnerabilities

[former_member275479]

Hi,

How to apply "secure" attribute to session cookies to ensure that they are sent vis HTTPS only in ABAP system?

Based on my research, i think login/ticket_only_by_https should be set to 1.

Please confirm and correct me if i am wrong. thanks

[former_member275479]

Thanks for the prompt response.

I compared the value of login/ticket_only_by_https parameter with another system which doesn't have the vulnerability and the value seems to be the default 0.

I went ahead and compared SAML config and found difference in Authentication response value

(SAML->Trusted providers -> Authentication Requirement--> Authentication response). The system which has Vulnerability is set to default and which doesn't is set to "ACS - application URL and binding- HTTP POST"

before making the parameter value, i wanted to ask if Authentication response is causing the issue?

Thanks.

[cris_hansen]

Hello,

Yes, you are correct.

You can use RZ11 and read the information about the parameter for information.

Warren also provided you with a KBA and a SAP Help page for additional documentation.

An extra documentation is available here.

Regards,

Cris

[warren_angerstein3]

Please take a look at OSS Note 1531399 and the following URL