Directory traversal in IS-H in utilities (reports), SAP security note 1775843

SAP security note 1775843, "Directory Traversal in IS-H Utilities (Reports)", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This SAP Security Note addresses a directory traversal vulnerability in the IS-H-PM, IS-H-BD-BUS, IS-H-PA-INS, and IS-H-TO components. An attacker could exploit this vulnerability to read arbitrary files on the remote server, potentially disclosing confidential information, or write arbitrary files, possibly corrupting data or altering system behavior.

Solution

Implement the corrections from SAP Note 1497003 – Potential directory traversals in applications as a prerequisite. Additionally, set up the necessary logical file names by following the manual activities outlined in SAP Note 1775843.

CVSS

Score 0

References

Affected components

• Industry-Specific Components > Hospital > Patient Management (IS-H-PM)
• Industry-Specific Components > Hospital > Basic Data > Business Partner (IS-H-BD-BUS)
• Industry-Specific Components > Hospital > Patient Accounting > Insurance Relationship (IS-H-PA-INS)
• Industry-Specific Components > Hospital > Tools (IS-H-TO)