Directory Traversal Vulnerability in a UserAdmin Application, SAP security note 2310790

SAP security note 2310790, "Directory Traversal Vulnerability in a UserAdmin Application". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

A UserAdmin application allows an attacker to exploit insufficient validation of path information provided by users, enabling characters that represent ‘traverse to parent directory’ to pass through to the file APIs.

Impacts of Directory Traversal Vulnerability:

• An attacker could read the content of arbitrary files on the remote server, exposing sensitive data.
• An attacker could overwrite, delete, or corrupt arbitrary files on the remote server.

Solution

Update your Java AS to a Support Package or release where the issue is fixed. Refer to the Support Package Patch Level section for details and available patches.

CVSS

Score 6.8 Vector: AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N

References

Affected components

• UMEADMIN 7.00 to 7.50