Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1502331-7)
SAP Support Packages
(SAPK-60308INEAFINSRV, SAPK-60409INEAFINSRV, SAPK-60503INEAFINSRV, SAPKGPFA32, SAPKGPFB20, SAPKGPFB21, SAPKGPFC24, SAPKGPFD19, SAPKIPBJ40)
Описание
There is a directory traversal with write or read and write authorization.
The programs contain an error when checking paths to which data transferred by a user is written. An attacker can use this to transfer any data to the remote system or to overwrite existing data.
The programs contain an error when checking paths to which data transferred by a user is written. An attacker can use this to transfer any data to the remote system or to overwrite existing data.
Как исправить
See Note 1497003 for additional important information and instructions. The corrections in Note 1497003 are an important prerequisite for the implementation of this note.
The following logical file name was created to enable the validation of the physical file name:
The following logical file name was created to enable the validation of the physical file name:
Ссылки
