SAP Note 1504116
SAP Security Note
High priority
SAP Security Note
High priority
SAP security note 1504116, "CM: Potential Directory Traversal ICL_DATA_UP_DOWNLOAD", is released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
A potential directory traversal issue exists in the ICL_DATA_UPLOAD_DOWNLOAD program.
Solution
Refer to SAP Note 1497003 for additional information and instructions. The corrections from Note 1497003 are required before implementing this note.
Reason and prerequisites
The affected programs contain vulnerabilities that may allow malicious users to:
- Read arbitrary files, potentially disclosing confidential information.
- Write arbitrary files, possibly corrupting data or altering system behavior.
References
This note refers to
Affected components
- INSURANCE: Versions 471, 472, 600, 602, 603, 604, 605
Full note on SAP: SAP Support Launchpad note 1504116
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].