SAP Security Note
High priority
SAP security note 1597146, “FI: Potential Directory Traversal – Italy (RFIDITBLIST)”, is a program error note released on 08.11.2011. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A potential directory traversal vulnerability exists in the RFIDITBLIST program, allowing attackers to access arbitrary files on the server.
Solution
Refer to SAP Note 1497003 for additional information and instructions. Implementing corrections from Note 1497003 is a prerequisite for applying this note.
The RFIDITBLIST application now passes an additional parameter (parameter_1 as sy-cprog) to the FILE_VALIDATE_NAME function module. This allows customers to configure physical paths for the logical file name FI_RFIDITBLIST_FILE.
Reason and prerequisites
The programs in the correction instructions contain vulnerabilities that could allow malicious users to:
- Read arbitrary files, potentially disclosing confidential information.
- Write arbitrary files, possibly corrupting data or altering system behavior.
CVSS
Score 0
References
- SAP Note 1497003 – Potential directory traversals in applications
- SAP Note 1478905 – Model for Countries with privileged tax system (Black list)
Affected components
- SAP_APPL (versions 46B, 46C, 470, 500, 600, 602, 603, 604, 605)
Full note on SAP: SAP Support Launchpad note 1597146
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].