FI-AA Data Takeover Potential Directory Traversal, SAP security note 1589216

SAP security note 1589216, “FI-AA Data Takeover: Potential Directory Traversal”, is a note. Below are the symptom, SAP recommended solution, references and the affected software components.

Description

Symptom

This vulnerability allows a malicious user to perform directory traversal in the FI-AA component, potentially writing arbitrary files on the remote server. This can lead to data corruption or alteration of system behavior.

Solution

To mitigate this vulnerability, apply the corrections from the following prerequisite SAP Notes before implementing this note:

• SAP Note 1497003 – Potential directory traversals in applications
• SAP Note 1605703 – RSFILECR: Potential directory traversals in applications

After applying the prerequisites, implement the corrections from SAP Note 1589216.

Please review the correction instructions carefully and ensure all prerequisites are met before applying the security note to avoid potential issues.

References

• SAP Note 1605703
• SAP Note 1497003

Affected components

• Financial Accounting > Asset Accounting > Basic Functions > Master Data (FI-AA-AA-A)
• SAP_APPL 31I, 40A to 40B, 45A to 45B, 46A to 46C, 470, 500, 600, 602, 603, 604, 605