Description
This note concerns a directory traversal with write or read-write authorization for the current DUEVA (DÜVA) download function in the statutory reporting in the interface for the BaFin (German Federal Financial Supervisory Authority) statutory reporting.
The error is found in the following components:
FS-SR-DE
The directory traversal with write or read-write authorization allows any data to be read or written using the network.
Available fix and Supported packages
- EA-FINSERV | 600 | 600
- EA-FINSERV | 603 | 603
- EA-FINSERV | 604 | 604
- EA-FINSERV | 605 | 605
- EA-FINSERV 600 | SAPKGPFD19 |
- EA-FINSERV 603 | SAPK-60308INEAFINSRV |
- EA-FINSERV 604 | SAPK-60409INEAFINSRV |
- EA-FINSERV 605 | SAPK-60503INEAFINSRV |
- EA-FINSERV 605 | SAPK-60504INEAFINSRV |
Affected component
- FS-SR-DE
Germany
CVSS
Score: 0
PoC
Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.
URL
https://launchpad.support.sap.com/#/notes/1502330
