Directory traversal in function group SUGPEWA, SAP security note 1584549

SAP security note 1584549, "Directory traversal in function group SUGPEWA", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A malicious user can exploit the directory traversal vulnerability in function group SUGPEWA to read arbitrary files on the remote server. This may result in the exposure of sensitive data.

Solution

To address this vulnerability, implement the attached corrections or import the relevant Support Package.

Reason and prerequisites

Function group SUGPEWA does not properly validate the file path used to reference files read from the remote server. As a result, an attacker with the necessary permissions can manipulate the file path to access unintended files within the system.

References

• Automatic checks for security notes using RSECNOTE (Note 888889)
• Additional Reference 1926261
• Additional Reference 1878193
• Additional Reference 1843776
• Additional Reference 1790828
• Additional Reference 1732061
• Additional Reference 1707161

Affected components

• SAP_BASIS