BCA Potential Directory Traversal, SAP security note 1502766

SAP security note 1502766, "BCA: Potential Directory Traversal", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

There is a potential directory traversal vulnerability in the following components:

• IS-B-BCA
• FIN-FSCM-IHC

Solution

Refer to SAP Note 1497003 for additional information and instructions. Implementing the corrections from this note is a prerequisite for applying SAP Note 1502766.

Reason and prerequisites

• Unauthorized File Reading: The programs included in the correction instructions contain vulnerabilities that allow malicious users to read arbitrary files on the remote server, potentially disclosing confidential information.
• Unauthorized File Writing: Some programs in the correction instructions have vulnerabilities that enable malicious users to write arbitrary files on the remote server, which could corrupt data or alter system behavior.

References

Affected components

• IS-B-BCA-AM (Industry-Specific Components > Bank > Bank Current Accounts > Account Management)
• FIN-FSCM-IHC (Financial Supply Chain Management > FSCM In-House Cash)