Directory traversal in Schedule Manager, SAP security note 1582138

SAP Note 1582138
SAP Security Note
High priority

SAP security note 1582138, "Directory traversal in Schedule Manager", is a program error note released on 14.06.2011. Below are the symptom and SAP recommended solution.

ComponentCross-Application Components > General Application Functions > Schedule Manager

CategoryProgram error

PriorityHigh priority

TypeSAP Security Note

Version2

StatusReleased for Customer

Released on14.06.2011

LanguageEnglish

Description

Symptom

Schedule Manager contains a vulnerability through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.

Solution

Please refer to Note 1497003 for additional information and instructions. The corrections from Note 1497003 are a prerequisite for the implementation of this note.

Reason and prerequisites

Schedule Manager fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, a malicious user can potentially direct the program to an arbitrary other file in the system, disclosing its contents.

CVSS

Score 0

Full note on SAP: SAP Support Launchpad note 1582138

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Directory Traversal #Schedule Manager #File Disclosure