Directory traversal in DI_CMS, LM-TOOLS, LM-CTS, SAP_DEVINF, SAP security note 1757675

SAP security note 1757675, "Directory traversal in DI_CMS, LM-TOOLS, LM-CTS, SAP_DEVINF", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

An attacker with write or read/write authorization can exploit this vulnerability to write arbitrary files to the remote server. This can lead to data corruption or alterations in system behavior.

Solution

• Identify installed components: check if any of the affected components listed above are installed on your Java application server.
• Apply patches: if applicable, install the corresponding patches attached to this SAP Note based on the release and Support Package level of your software components. Use tools like JSPM, SDM, or SUM for patch installation.

CVSS

Score 4.9 Vector: AV:N/AC:M/AU:S/C:N/I:P/A:P

Affected components

• DI_CMS (Release 7.00 to 7.31)
• LM-TOOLS (Release 7.01 and 7.02)
• LM-CTS (Release 7.20 to 7.31)
• SAP_DEVINF (Release 6.40)