FI Potential Directory Traversal – Argentina, SAP security note 1594294

SAP security note 1594294, "FI: Potential Directory Traversal – Argentina", is a note. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note has been updated. For more detailed information, see Security Note 2178874.

Potential Directory Traversal in the following components: XX-CSC-AR.

Solution

Please refer to Note 1497003 for additional information and instructions. The corrections from this note are a prerequisite for implementing this security note.

Reason and prerequisites

• The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.
• Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.

References

• Potential directory traversals in applications (Note 1497003)

Affected components

• XX-CSC-AR (Electronic Duplicate Invoice Functionality for Argentina)
• SAP_APPL versions 46C, 470, 500, 600, 602, 603, 604, 605