Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
Производитель ПО
Наименование ПО
SAP Notes
(1510789-10)
SAP Support Packages
(SAPK-110B3INEAHRGXX, SAPK-20094INEAHRGXX, SAPK-50079INEAHRGXX, SAPK-60062INEAHRGXX, SAPK-60241INEAHRGXX, SAPK-60336INEAHRGXX, SAPK-60428INEAHRGXX, SAPK-60504INEAHRGXX, SAPK-60505INEAHRGXX, SAPKE46BE1, SAPKE46CG8)
Описание
Travel expenses management fails to correctly validate the path to which a user-submitted file is written. As a result, a malicious user can potentially overwrite data in the remote system.
Как исправить
See Note 1497003 for more information. The corrections from Note 1497003 are a prerequisite for this note.
This note creates the following logical file names to check the physical file names:
FI_TV_RPRCCC00_FILE
The following programs use this logical file name:
RPRCCC00 "Import of Credit Card Data (Credit Card Clearing)"
RPRCCC_CREATE_TESTFILE "Create a test file for credit card clearing"
RPRCCC_CREATE_CORRECTION_FILE
The following parameters are used in this context:
<PARAM_1> The "Company ID" field of the selection screen
The logical path for the logical file name FI_TV_RPRCCC00_FILE is as follows:
FI_TV_CCC_FILES
FI_TV_RPRIRB00_30_FILE
The following programs use this logical file name:
RPRIRB00_30
RPRC50R3
The logical path for the logical file name FI_TV_RPRIRB00_30_FILE is as follows:
FI_TV_POSTING_RUN_FILES
FI_TV_RPRFIN00_30_FILE
The following programs use this logical file name:
RPRFIN00_30
RPREPR3C
The logical path for the logical file name FI_TV_RPRFIN00_30_FILE is as follows:
FI_TV_POSTING_RUN_FILES
FI_TV_CCC_AMEX_FILE
The following programs use this logical file name:
RPRCCC_READ_BTA
RPRCCC_READ_KR1025
The following parameters are used in this context:
<PARAM_1> The "Company ID" field of the selection screen
The logical path for the logical file name FI_TV_CCC_AMEX_FILE is as follows:
FI_TV_CCC_AMEX_FILES
FI_TV_RPRTAX_FILE
The following programs use this logical file name:
RPRTAX_FINLAND
The logical path for the logical file name FI_TV_RPRTAX_FILE is as follows:
FI_TV_RPRTAX_FILES
This note creates the following logical file names to check the physical file names:
FI_TV_RPRCCC00_FILE
The following programs use this logical file name:
RPRCCC00 "Import of Credit Card Data (Credit Card Clearing)"
RPRCCC_CREATE_TESTFILE "Create a test file for credit card clearing"
RPRCCC_CREATE_CORRECTION_FILE
The following parameters are used in this context:
<PARAM_1> The "Company ID" field of the selection screen
The logical path for the logical file name FI_TV_RPRCCC00_FILE is as follows:
FI_TV_CCC_FILES
FI_TV_RPRIRB00_30_FILE
The following programs use this logical file name:
RPRIRB00_30
RPRC50R3
The logical path for the logical file name FI_TV_RPRIRB00_30_FILE is as follows:
FI_TV_POSTING_RUN_FILES
FI_TV_RPRFIN00_30_FILE
The following programs use this logical file name:
RPRFIN00_30
RPREPR3C
The logical path for the logical file name FI_TV_RPRFIN00_30_FILE is as follows:
FI_TV_POSTING_RUN_FILES
FI_TV_CCC_AMEX_FILE
The following programs use this logical file name:
RPRCCC_READ_BTA
RPRCCC_READ_KR1025
The following parameters are used in this context:
<PARAM_1> The "Company ID" field of the selection screen
The logical path for the logical file name FI_TV_CCC_AMEX_FILE is as follows:
FI_TV_CCC_AMEX_FILES
FI_TV_RPRTAX_FILE
The following programs use this logical file name:
RPRTAX_FINLAND
The logical path for the logical file name FI_TV_RPRTAX_FILE is as follows:
FI_TV_RPRTAX_FILES
Ссылки
