Solution : https://service.sap.com/sap/support/notes/1946234 (SAP Service marketplace login required)
Summary :
This SAP Note emphasizes the necessity for adequate security measures when using Fiori applications that permit document uploads and displays. It mandates the installation of a virus scanner linked to the backend system, with suitably restrictive scanning profiles, to mitigate risks such as Cross-Site Scripting (XSS) vulnerabilities by disallowing dangerous mime-types. Configuration specifics and relevant applications, such as SAP CRM and ERP modules that interact with document functionality, are listed with designated scan profiles like /SCMS/KPRO_CREATE. Further guidance is provided on overriding default profiles via administrative parameter settings.
Key words :
sap erp report quality issue ui_qm_create /scms/kpro_create sap portf proj mgmt approve decision points ppm_pfmdcpt_apv /scms/kpro_create sap portf proj mgmt change portfolio items ppm_pfmitem_chg /scms/kpro_create sap portf proj mgmt create portfolio item proposals ppm_pfmitpr_cre /scms/kpro_create sap portf proj mgmt confirm project tasks ppm_protsk_cnf /scms/kpro_create, customer component xx-ser-rel business suite release information priority recommendations / additional info category release planning information validity, sap erp sales order fulfillment monitor sd_sofulfil_mon /scms/kpro_create, opportunities crm_opprtnty /scms/kpro_create sap erp, leads crm_leads /scms/kpro_create sap crm, accounts crm_myaccounts /scms/kpro_create sap crm, appointments crm_mycal /scms/kpro_create sap crm, contacts crm_mycont /scms/kpro_create sap crm, quotations sd_myquotes /scms/kpro_create, scan profile /scms/kpro_create
Related Notes :
| 1947895 | Invalid data when activating VSI profile /SIHTTP/HTTP_UPLOAD |
| 1494278 | NW-VSI: Summary of Virus Scan Adapter´s for SAP integration |
| 786179 | Data security products: Application in the antivirus area |
| 1959274 | |
| 1959305 | Release Information Note: SAP Fiori transactional apps for SAP CRM 1.0 |