Directory traversal in IS-H-CM-OUT, SAP security note 1607018

SAP security note 1607018, “Directory traversal in IS-H-CM-OUT”, is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A directory traversal vulnerability has been identified in the IS-H-CM-OUT component (Industry-Specific Components > Hospital > Communication with Systems Outside the Hospital). This vulnerability allows a malicious user to potentially read arbitrary files on the remote server, which may lead to the disclosure of confidential information.

Exploitation of this vulnerability can result in unauthorized access to sensitive files, compromising the confidentiality and integrity of the system.

Solution

• Ensure that Note 1497003 is applied.
• Implement Note 1607749 for IS-H.
• Follow the correction instructions provided in this note.

References

• Note 1607749 – Directory traversal in IS-H, central program part

Affected components

• IS-H 463B
• IS-H 472
• IS-H 600
• IS-H 602
• IS-H 603
• IS-H 604
• IS-H 605