Skip links
Arpine Maghakyan

Arpine Maghakyan

Security Researcher of RedRays.

Directory Traversal vulnerability in MDG Data Export, SAP security note 2328182

Description

MDG Data Export allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs.

Some well-known impacts of Directory Traversal vulnerability are –

  • attacker could read content of arbitrary files on the remote server and expose sensitive data
  • attacker could overwrite, delete, or corrupt arbitrary files on the remote server 

Available fix and Supported packages

  • S4CORE | 100 | 100
  • SAP_BS_FND | 731 | 731
  • SAP_BS_FND | 746 | 746
  • SAP_BS_FND | 747 | 747
  • SAP_BS_FND | 748 | 748
  • | SAPK-S4CLOUD_1608 |
  • S4CORE 100 | SAPK-10003INS4CORE |
  • SAP_BS_FND 748 | SAPK-74803INSAPBSFND |
  • SAP_BS_FND 731 | SAPK-73118INSAPBSFND |
  • SAP_BS_FND 746 | SAPK-74611INSAPBSFND |
  • SAP_BS_FND 747 | SAPK-74713INSAPBSFND |

Affected component

    CA-MDG-ML
    Mass Load

CVSS

Score: 0

Exploit

Detailed vulnerability information added to RedRays Security Platform. Contact [email protected] for details.

URL

https://launchpad.support.sap.com/#/notes/2328182

TAGS

#Path-traversal
#backtracking
#directory-climbing&65279

More to explorer

SAP Cloud Connector Certificate Validation Issue

Date of Release: February 13, 2024 Advisory ID: CVE-2024-25642 Affected Software: SAP Cloud Connector Versions Affected: 2.15.0 to 2.16.1 Vulnerability Summary:A critical vulnerability,

Protect Your SAP with RedRays Security Platform

Explore the Power of Our Scanner with an Interactive Prototype Below