Directory traversal in JSF, SAP security note 2235088

SAP security note 2235088, "Directory traversal in JSF". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

JSF contains a vulnerability through which an attacker can potentially read arbitrary files on the remote server, possibly disclosing confidential information.

Solution

Update AS Java to the latest version. See the Support Package Patch Level section for details.

Reason and prerequisites

JSF fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, an attacker can potentially direct the program to another arbitrary file in the system, disclosing its contents.

CVSS

Score 3.5 Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N

References

• Central note for SAP NetWeaver 7.31 SP18 Application Server Java
• Collective Note: SAP NetWeaver 7.5 SP02 – Application Server Java (AS Java)

Affected components

• J2EE-FRMW: Versions 7.10, 7.20, 7.30, 7.31, 7.40, 7.50