SAP Security Note
Medium priority
SAP security note 2032811, "Directory traversal in PY-PH", is a program error note released on 07.08.2015. Below are the symptom and SAP recommended solution.
Description
Symptom
[PY-PH] contains a vulnerability through which an attacker can potentially read arbitrary files on the remote server, possibly disclosing confidential information.
Solution
To get the corrections, apply the relevant HR support package or correction instructions attached with this note.
Reason and prerequisites
[PY-PH] fails to correctly validate the path that is used to reference a file that is read from the remote server. As a result, an attacker can potentially direct the program to an arbitrary other file in the system, disclosing its contents.
Full note on SAP: SAP Support Launchpad note 2032811
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].