Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1497170-3)
SAP Support Packages
(SAPKB46C62, SAPKB62070, SAPKB64028, SAPKB70023, SAPKB70024, SAPKB70108, SAPKB70109, SAPKB70207, SAPKB71012, SAPKB71107, SAPKB72005, SAPKB73002)
Описание
These Function module fail to correctly validate the path a user-submitted file is written to. This means that an attacker can potentially overwrite data on the remote system.
Как исправить
Refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.
Logical File Names Used in this Solution: The logical filename that has been created in order to enable the validation of physical file name is ARCHIVLINK_SERVERPATH.
Logical File Paths Used in this Solution: The logical file name ARCHIVLINK_SERVERPATH use the logical file path ARCHIVLINK_SERVERPATH_LP.
Logical File Names Used in this Solution: The logical filename that has been created in order to enable the validation of physical file name is ARCHIVLINK_SERVERPATH.
Logical File Paths Used in this Solution: The logical file name ARCHIVLINK_SERVERPATH use the logical file path ARCHIVLINK_SERVERPATH_LP.
Ссылки
