SAP security note 1509372, "Healthcare Clinical System – Potential Directory Traversal". Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
Potential Directory Traversal in the following programs:
- RN2OS_COPY_FILE
- RN2HL7_INSD_TESTDATEN
The path name is not handled correctly.
Solution
Please refer to SAP Note 1497003 for additional information and instructions. The affected programs are obsolete. The erroneous code has been removed. Apply the correction or the appropriate support package.
Reason and prerequisites
This vulnerability allows a malicious user to potentially write arbitrary files on the remote server, which could lead to data corruption or alterations in system behavior.
References
Affected components
- IS-H 463B to 605
Full note on SAP: SAP Support Launchpad note 1509372
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].