IS Potential Directory Traversal, SAP security note 1502931

SAP security note 1502931, "IS: Potential Directory Traversal", is a program error note released on December 14, 2010. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

This security note addresses a potential directory traversal vulnerability in the IS-HER-CM component (Industry-Specific Components > Higher Education and Research > Student Lifecycle Management). The vulnerability allows a malicious user to potentially read arbitrary files on the remote server, possibly disclosing confidential information. Additionally, some programs may allow writing arbitrary files, potentially corrupting data or altering system behavior.

Solution

Refer to SAP Note 1497003 for additional information and instructions. The corrections from Note 1497003 are a prerequisite for implementing this note.

Reason and prerequisites

Ensure the following SAP Notes are applied:

• 1312653 – PIQ_XML00 should generate XML files based on root object
• 1322239 – Program RHIQ_XML_ACADSTRUC dumps when run in background

CVSS

Score 0

References

• SAP Note 1497003 – Potential directory traversals in applications

Affected components

• IS-PS-CA: 603, 604, 605