Directory Traversal in BC-SRV-KPR, SAP security note 1578576

SAP security note 1578576, “Directory Traversal in BC-SRV-KPR”, is a program error note released on September 13, 2011. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

BC-SRV-KPR contains a vulnerability that allows a malicious user to read arbitrary files on the remote server, disclosing potentially confidential information.

Solution

Implement the corrections provided in the security note or import the relevant support package for your SAP_BASIS version. Refer to the Support Packages corresponding to your component version.

Reason and prerequisites

BC-SRV-KPR fails to correctly validate the path used to reference files read from the remote server. This allows an attacker to point the program to an arbitrary file on the system, disclosing its contents.

CVSS

Score 0

Affected components

• SAP_BASIS (Versions 46C, 620, 640, 700, 702, 710, 720, 730, 800)