Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1502918-6)
SAP Support Packages
(SAPKB64027, SAPKB64028, SAPKB70023, SAPKB70024, SAPKB70108, SAPKB70109, SAPKB70206, SAPKB70207, SAPKB71011, SAPKB71012, SAPKB71106, SAPKB71107, SAPKB72004, SAPKB72005, SAPKB73001, SAPKB73002)
Описание
Archivelink Function module fails to correctly validate the path with which a file that is read from the remote server is referenced. This means that an attacker can potentially point the program to an arbitrary other file on the system, disclosing its contents.
Как исправить
Refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.
Logical File Names Used in this Solution:
The following logical file names have been created in order to enable the validation of physical file names:
ARCHIVLINK_FILE.
Logical File Paths Used in this Solution:
The logical file name ARCHIVLINK_FILE use the logical file path ARCHIVLINK_FILE_LP.
Logical File Names Used in this Solution:
The following logical file names have been created in order to enable the validation of physical file names:
ARCHIVLINK_FILE.
Logical File Paths Used in this Solution:
The logical file name ARCHIVLINK_FILE use the logical file path ARCHIVLINK_FILE_LP.
Ссылки
