Potential directory traversals in PA-PA-US, SAP security note 1620339

SAP security note 1620339, "Potential Directory Traversals in PA-PA-US". Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

Directory traversals in PA-PA-US can be exploited to write arbitrary files on the server, posing significant security risks including data corruption and unauthorized system modifications.

Solution

To address this vulnerability, the following steps should be taken:

• Install the Relevant HR Support Packages: Ensure that the support packages listed below are installed and relevant to your system.
• Apply Correction Instructions via Note Assistant (SNOTE): Access the correction instructions included in this note using the Note Assistant (SNOTE). Refer to Note 1497003 for additional information and prerequisites. The corrections in Note 1497003 are necessary before implementing this note.
• Manual Customizing Steps: Follow the manual correction instructions provided to configure logical file paths and names. Detailed steps are outlined in the note to ensure secure separation of data.

References

• Note 1497003 – Potential directory traversals in applications

Affected components

• SAP_HR
• SAP_HRCUS
• EA-HRCUS