FIN-FSCM-TRM-TM Potential directory traversal, SAP security note 1600430

SAP security note 1600430, "FIN-FSCM-TRM-TM: Potential Directory Traversal Vulnerability". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Potential directory traversal in FIN-FSCM-TRM-TM (Financials > Financial Supply Chain Management > Treasury and Risk Management > Transaction Manager). This vulnerability allows malicious users to read or write arbitrary files on the remote server, potentially disclosing confidential information or corrupting data.

Malicious users could read arbitrary files, potentially disclosing confidential information, or write arbitrary files, possibly corrupting data or altering system behavior.

Solution

• Apply prerequisite note: ensure that Note 1497003 is implemented before applying this security note.
• Implement corrections: apply the correction instructions provided in this note. Logical file names and paths have been created to validate physical file names.
• Recommendations: create a directory structure reflecting user or program names to securely separate data, and use these details when setting up physical paths and file names for logical file paths and names.

References

• Note 954198: Error CONVT_NO_NUMBER when performing TSW2 in Unicode System
• Note 1292270: TSW1/TSW2 error message FZ205, UNKNOWN_DP_ERROR

Affected components

• SAP_APPL: 40B, 45B, 46B, 46C
• EA-FINSERV: 110, 200, 500, 600, 603, 604, 605
• BANK/CFM: 463_20