Potential directory traversal in utility report RPUOTFL0, SAP security note 1591557

SAP security note 1591557, “Potential directory traversal in utility report RPUOTFL0.” Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Security Note addresses a potential directory traversal vulnerability in the utility report RPUOTFL0. A malicious user could exploit this vulnerability to read arbitrary files on the remote server, potentially disclosing confidential information.

Solution

To mitigate the vulnerability, follow these steps:

• Apply corrections from Note 1497003, which are a prerequisite for this note.
• Implement this note using SAP Solution Manager or transaction SNOTE.
• If applying manually via SNOTE, perform the required manual pre-implementation steps as outlined in the attached PDF document for creating or modifying the HR_OT_FILEPORT logical file.

Reason and prerequisites

The programs specified in the correction instructions contain vulnerabilities that allow unauthorized access to the server’s file system. Implementing this note requires applying the corrections from Note 1497003, which serve as a prerequisite.

CVSS

Score 0

References

• Note 1507936 – HCM: Potential Directory Traversal in German Payroll PY-DE
• Note 1507935 – HCM: Potential Directory Traversal Internat. Payroll PY-XX
• Note 1497003 – Potential directory traversals in applications

Affected components

• SAP_HR 31I to 46C
• SAP_HRRXX 470 to 604