SAP security note 1596473, "Directory Traversal in XX-CSC-IN-FI". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Potential Directory Traversal for J_1I_QER_FILE.
Solution
Please refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 are a prerequisite for the implementation of this note.
The following logical file name has been created to enable the validation of the physical file name: logical filename FI_J1IQEREFILE_FILE, used by program J_1I_QER_EFILE.
The logical file name mentioned above uses the logical file path FI_J1IQER_FILE.
Reason and prerequisites
The programs contained in the correction instructions have vulnerabilities that allow a malicious user to potentially read arbitrary files on the remote server, possibly disclosing confidential information. Some of the programs contained in the correction instructions have a vulnerability that allows a malicious user to potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
CVSS
Score 0
References
Affected components
- SAP_APPL: 470, 500, 600, 602, 603, 604, 605
- CIN: 40A
Full note on SAP: SAP Support Launchpad note 1596473
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
