High priority
SAP security note 1502331, "Directory Traversal Vulnerability in DUEVA Download Function", is a program error note released on 14.12.2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
An error exists in the component FS-SR-DE that permits unauthorized reading and writing of data via the network through the DUEVA download function.
Solution
To mitigate this vulnerability, implement the corrections detailed in SAP Note 1497003. The corrections in this note are a crucial prerequisite for applying the fixes in SAP Note 1502331.
References
Affected components
- EA-FINSERV: Versions 110, 200, 500, 600, 603, 604, 605
- BANK/CFM: Version 463_20
Full note on SAP: SAP Support Launchpad note 1502331
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].