Skip links
RedRays - Your SAP Security Solution
Picture of Vahagn Vardanian

Vahagn Vardanian

Co-founder and CTO of RedRays

SAP Security on Udemy

FI-AP/AR Potential Directory Traversal, SAP security note 1588734

SAP Note 1588734
High priority

SAP security note 1588734, "FI-AP/AR: Potential Directory Traversal", is released on July 12, 2011. Below are the symptom, SAP recommended solution and the affected software components.

ComponentFinancial Accounting > Accounts Payable (FI-AP), Financial Accounting > Accounts Receivable (FI-AR)
PriorityCorrection with high priority
StatusReleased for Customer
Released onJuly 12, 2011

Description

Symptom

Potential Directory Traversal in FI-AR and FI-AP components.

Solution

Refer to Note 1497003 for additional information and instructions. Implementing the corrections from Note 1497003 is a prerequisite for applying this security note.

Reason and prerequisites

Vulnerabilities in the correction instructions enable reading arbitrary files, risking confidential data exposure.

Some programs allow writing arbitrary files, which can corrupt data or alter system behavior.

References

Affected components

  • SAP_APPL 31I
  • SAP_APPL 40B
  • SAP_APPL 45B
  • SAP_APPL 46B
  • SAP_APPL 46C
  • SAP_APPL 470
  • SAP_APPL 500
  • SAP_APPL 600
  • SAP_APPL 602
  • SAP_APPL 603
  • SAP_APPL 604
  • SAP_APPL 605

Full note on SAP: SAP Support Launchpad note 1588734

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Path traversal
#Directory Traversal
#FI-AP
#FI-AR

Explore More