Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1502329-9)
SAP Support Packages
(SAPK-60308INEAFINSRV, SAPK-60409INEAFINSRV, SAPK-60503INEAFINSRV, SAPKGPFA32, SAPKGPFB20, SAPKGPFC24, SAPKGPFD19, SAPKIPBJ40)
Описание
There is a directory traversal with write or read and write authorization. The reports RFVZWPD1, RFVZWPD2 and RFVZFIMA of the old regulatory reporting solution for Austria contain an error that affects the checking of paths to which the data transferred by a user is written. An attacker can use this to transfer any data to the remote system or to overwrite existing data.
Как исправить
See Note 1497003 for additional important information and instructions. The corrections in Note 1497003 are an important prerequisite for the implementation of this note.
The following logical file names were created to enable the validation of the physical file names:
The following logical file names were created to enable the validation of the physical file names:
Ссылки
