Карточка уязвимости
Характеристики уязвимости
Уровень опасности
Оценка CVSS
(AV:N/AC:L/AU:N/C:P/I:N/A:NSAP)
Производитель ПО
Наименование ПО
SAP Notes
(1779578-2)
SAP Support Packages
(ENGINEAPI_710_SP013_000009, ENGINEAPI_710_SP014_000007, ENGINEAPI_710_SP015_000003, ENGINEAPI_710_SP016_000000, ENGINEAPI_710_SP017_000000, ENGINEAPI_710_SP999999_999999, ENGINEAPI_711_SP008_000013, ENGINEAPI_711_SP009_000012, ENGINEAPI_711_SP010_000005, ENGINEAPI_711_SP011_000000, ENGINEAPI_711_SP012_000000, ENGINEAPI_711_SP999999_999999, ENGINEAPI_720_SP006_000013, ENGINEAPI_720_SP007_000010, ENGINEAPI_720_SP008_000003, ENGINEAPI_720_SP009_000000, ENGINEAPI_720_SP999999_999999, ENGINEAPI_730_SP004_000014, ENGINEAPI_730_SP005_000015, ENGINEAPI_730_SP007_000013, ENGINEAPI_730_SP008_000003, ENGINEAPI_730_SP009_000000, ENGINEAPI_730_SP999999_999999, ENGINEAPI_731_SP001_000010, ENGINEAPI_731_SP002_000008, ENGINEAPI_731_SP003_000008, ENGINEAPI_731_SP004_000003, ENGINEAPI_731_SP005_000001, ENGINEAPI_731_SP006_000000, ENGINEAPI_731_SP007_000000, ENGINEAPI_731_SP999999_999999)
Описание
ENGINEAPI fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, an attacker can potentially direct the program to an arbitrary other file in the system, disclosing its contents.
Как исправить
Update to the last patch levels of the corresponding SP level. The fix is available in:NW 7.10 - SP13 and higherNW 7.11 - SP08 and higherNW 7.20 - SP06 and higherNW 7.30 - SP04 and higherNW 7.31 - SP01 and higher
Ссылки
