Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1267536-2)
SAP Support Packages
(SAP_CPM_BPC_51_999999_999999, SAP_CPM_BPC_51_SP004_000000, SAP_CPM_BPC_51_SP999999_999999)
Описание
The server module that returns a file's content did not check whether a file name parameter contained "..".
Как исправить
Corrected in BPC 5.1 SP4.
The server module that returns a file's content now checks if the file name parameter contains "..".
If the file name parameter contains "..", the server module does not read the file and returns the error message, "The path cannot be found."
The server module that returns a file's content now checks if the file name parameter contains "..".
If the file name parameter contains "..", the server module does not read the file and returns the error message, "The path cannot be found."
Ссылки
