Unrestricted File Upload vulnerability in Customer Business Planning application, SAP security note 2407351

SAP security note 2407351, "Unrestricted File Upload Vulnerability in Customer Business Planning Application", is a program error note released on 05.01.2017. Below are the symptom, SAP recommended solution and the affected software components.

Description

Symptom

The Customer Business Planning application allows an attacker to upload any file, including script files, without proper file format validation.

Impacts of Unrestricted File Upload Vulnerability:

• Malicious file insertion or modification
• Makes the website vulnerable to other attacks such as Cross-Site Scripting (XSS)

Solution

Implement the attached correction instructions and configure an appropriate virus scanner profile. You can download the correction for SNOTE here and the PDF version of this note here.

Reason and prerequisites

Missing file upload validation.

CVSS

Score 0

Affected components

• CBPC: From 200 to 200