SAP security note 1596424, “FI-Potential Directory Traversal: RFQSCI01”. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Potential Directory Traversal for RFQSCI01.
Solution
Please refer to note 1497003 for additional information and instructions. The corrections from note 1497003 are a prerequisite for implementation of this note.
- Logical filename: FI_IDFICL_FILE
- Program using this logical filename: RFQSCI01
- Logical file path: FI_IDFICL_FILE_PATH
Reason and prerequisites
1. The programs contained in the correction instructions contain vulnerabilities through which a malicious user can potentially read arbitrary files on the remote server, possibly disclosing confidential information.
2. Some of the programs contained in the correction instructions contain a vulnerability through which a malicious user can potentially write arbitrary files on the remote server, possibly corrupting data or altering system behavior.
CVSS
Score 0
References
This note refers to
Referenced by
Affected components
- FI-AP-AP-Q1 (Financial Accounting > Accounts Payable > Basic Functions > Withholding Tax (Reporting))
Full note on SAP: SAP Support Launchpad note 1596424
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
