FIN-CGV-MIC Potential Directory Traversal, SAP security note 1518726

SAP security note 1518726, "FIN-CGV-MIC: Potential Directory Traversal" Below are the symptom, reason and prerequisites, SAP recommended solution, CVSS score and references.

Description

Symptom

Potential Directory Traversal in the following components: FIN-CGV-MIC.

Solution

Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.

• Logical file name FIN_CGV_MIC_DATA is used by program FOPCB_MOVE_TO_APPLSERV (parameter <PARAM_1>: program name) and uses the logical file path FIN_BASIS_ROOT.

Reason and prerequisites

The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information. Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

CVSS

Score 0

References