Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1501905-6)
SAP Support Packages
(SAPK-60308INEAFINSRV, SAPK-60409INEAFINSRV, SAPK-60503INEAFINSRV, SAPKGPFA32, SAPKGPFB21, SAPKGPFC24, SAPKGPFD19, SAPKIPBJ40)
Описание
There is a directory traversal with write or read and write authorization. A report in the old regulatory reporting for the Austrian FMA contains an error when checking paths to which data transferred by a user is written. An attacker can use this to transfer any data to the remote system or to overwrite existing data.
Как исправить
See Note 1497003 for additional important information and instructions. The corrections in Note 1497003 are an important prerequisite for the implementation of this note.
The following logical file names were created to enable the validation of the physical file names:
The following logical file names were created to enable the validation of the physical file names:
Ссылки
