Beiträge in diesem Abschnitt

Weitere anzeigen

Enabling scripts in Portfolio 4.0.1 and later [DE]

Avatar
Don J.
  • Aktualisiert

Dieser Artikel ist nicht in Deutsch verfügbar. Durch Aufrufen dieses Artikels unterstützen Sie uns, dessen Übersetzung zukünftig in Betracht zu ziehen.

Falls Sie zusätzliche Unterstützung oder für den Kundendienst relevante Fragen haben, wenden Sie sich bitte an unser deutsches Kundendienst-Team über dieses Formular: https://help.extensis.com/hc/de/requests/new

Portfolio 3.6.3 and 4.0 were found to have a java reflection security issue that affected our Web Client scripting engine: CVE-2022-24252.

We resolved the issue in Portfolio 4.0.1 by disallowing the scripting engine from having read, write, and class loading access to specific locations and libraries.

This has the undesirable side effect of causing some Web Client scripts to fail when they are run.

If you find you have vital scripts that don’t run because of this update, you can enable scripting access to the restricted locations.

Important: Enabling scripting access in this way will effectively disable the security update for CVE-2022-24252.

While cumbersome, it is possible to disable the security update, run the required scripts, then re-enable the update.

Enable scripting access on Windows Server

  1. Open a Command Prompt or PowerShell window with Admin privileges.

  2. In the Command Prompt window, type

    notepad "%ProgramData%\Extensis\Portfolio Server\.preferences"

    In the PowerShell window, type

    notepad "$Env:ProgramData\Extensis\Portfolio Server\.preferences"

    This will open the .preferences file in Notepad.

  3. Scroll to the end of the file and on a new line, type

    server.scripting.allow.java.reflection=true

    then press Enter.

  4. Press Ctrl-S to save the file, then exit Notepad.

  5. Close the Command Prompt or PowerShell window.

  6. Restart Portfolio for the change to take effect.

Note: If you ever want to re-enable the security solution for CVE-2022-24252 then re-edit the file, find the line with server.scripting.allow.java.reflection=true, change true to false, save your changes, and restart Portfolio.

Enable scripting access on Macintosh

  1. Open Terminal and type pico /Library/Application\ Support/Extensis/Portfolio\ Server/.preferences then press Return.

    This opens the .preferences file in the pico editor.

  2. Press Ctrl-V until the block cursor is on a new line at the end of the file (press Return if necessary to get an empty line).

  3. Type server.scripting.allow.java.reflection=true and press Return.

  4. Press Ctrl-O then press Return to save the file.

  5. Once the file is saved, press Ctrl-X to exit the pico editor.

  6. Quit Terminal, then restart Portfolio for the change to take effect.

Note: If you ever want to re-enable the security solution for CVE-2022-24252 then re-edit the file, find the line with server.scripting.allow.java.reflection=true, change true to false, save your changes, and restart Portfolio.

Verwandte Beiträge