Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1507980-8)
SAP Support Packages
(SAPK-60308INEAFINSRV, SAPK-60409INEAFINSRV, SAPK-60503INEAFINSRV, SAPK-60504INEAFINSRV, SAPKGPFA32, SAPKGPFB21, SAPKGPFC25, SAPKGPFD19, SAPKIPBJ40)
Описание
The redemption schedule program FTBAS_SCHEDULE_BATCH_LOAD fails to correctly validate the path with which a file that is read from the remote server is referenced. Through this, an attacker can potentially point the program to an arbitrary other file on the system, disclosing its contents.
Как исправить
Please implement the correction instructions associated with this note. Alternatively, you could apply the support package also.
Please refer to the note 1497003 for more details.
The following logical path and file names have been created in order to enable the validation of the physical file names:
logical path names:
FTRM_FTR_RED_SCHEDULE
logical file names:
FTRM_FTR_RED_SCHEDULE
Class method using this logical file names:
CL_RDPT_SCHEDULE_PARSER CONSTRUCTOR
Parameters used in this context:
No parameters
Please refer to the note 1497003 for more details.
The following logical path and file names have been created in order to enable the validation of the physical file names:
logical path names:
FTRM_FTR_RED_SCHEDULE
logical file names:
FTRM_FTR_RED_SCHEDULE
Class method using this logical file names:
CL_RDPT_SCHEDULE_PARSER CONSTRUCTOR
Parameters used in this context:
No parameters
Ссылки
