Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

Directory traversal in ABAP Language, SAP security note 1560331

SAP Note 1560331
SAP Security Note
High priority

SAP security note 1560331, "Directory traversal in ABAP Language", released on 13.09.2011. Below are the symptom and SAP recommended solution.

ComponentBasis Components > ABAP Runtime Environment – ABAP Language Issues Only > Syntax, Compiler, Runtime
PriorityCorrection with high priority
TypeSAP Security Note
StatusReleased for Customer
Released on13.09.2011

Description

Symptom

Some ABAP Language statements contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

Solution

Apply the kernel patch levels mentioned in this note at least. After the application of the fix, authorization for the respective file operations is required.

Reason and prerequisites

Some ABAP Language statements fail to correctly validate the path to which a user-submitted file is written. As a result, a malicious user can potentially overwrite data in the remote system.

CVSS

Score 3.6 Vector: AV:N/AC:H/AU:S/C:N/I:P/A:P

Full note on SAP: SAP Support Launchpad note 1560331

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Syntax
#Compiler
#Runtime

Explore More