SAP security note 1521853, "Directory Traversal in BC-ABA-SC". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
BC-ABA-SC contains a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
Solution
Please apply the support package mentioned in this note, or the correction instructions.
Reason and prerequisites
BC-ABA-SC fails to correctly validate the path a user-submitted file is written to. Through this, an attacker can potentially overwrite data on the remote system.
CVSS
Score 0
Affected components
- SAP_APPL 45B
- SAP_BASIS 46A to 46D
- SAP_BASIS 610 to 640
- SAP_BASIS 700 to 702
- SAP_BASIS 710 to 730
- SAP_BASIS 72L to 800
Full note on SAP: SAP Support Launchpad note 1521853
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].