SAP security note 2896682, “[CVE-2020-6225] Directory Traversal vulnerability in SAP NetWeaver (Knowledge Management)”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP NetWeaver Knowledge Management does not sufficiently validate path information provided by users, allowing characters that represent ‘traverse to parent directory’ to pass through to the file APIs. This vulnerability enables an attacker to overwrite, delete, or corrupt arbitrary files on the remote server, leading to Path Traversal.
Solution
The vulnerability has been addressed in the code to prevent exploitation. Implement the Support Packages and Patches referenced by this SAP Note.
There are no known impacts on existing functionalities after applying the security note. A restart after deployment of the fix is mandatory, as KM does not support hot deployment.
CVSS
Score 9.1 Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:L
References
Affected components
- KMC-CM: Versions 7.00 to 7.50
- KMC-WPC: Versions 7.30 to 7.50
Full note on SAP: SAP Support Launchpad note 2896682
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].