Directory traversal in CA-DMS, SAP security note 1823920

SAP security note 1823920, "Directory traversal in CA-DMS". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

CA-DMS contains a vulnerability through which an attacker can potentially read arbitrary files on the remote server, possibly disclosing confidential information.

Solution

Refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementing this note.

Logical file names used in this solution (under transaction File):

• Maintain Logical File Path Definition – Name: DMS_LOG_FILE_PATH – Logical File Path for DMS
• Maintain Logical File Name Definition, Cross-Client – Name: DMS_LOG_FILE_PATH – Logical File Name for DMS

Reason and prerequisites

CA-DMS fails to correctly validate the path used to reference a file read from the remote server. As a result, an attacker can potentially direct the program to an arbitrary file in the system, disclosing its contents.

CVSS

Score 0

References

Affected components

• SAP_APPL 46C
• SAP_APPL 470
• SAP_APPL 500
• SAP_APPL 600
• SAP_APPL 602
• SAP_APPL 603
• SAP_APPL 604
• SAP_APPL 605
• SAP_APPL 606
• SAP_APPL 616