High priority
SAP security note 1598420, “ZFM/ALC: Potential Directory Traversal”, released on November 8, 2011. Below are the symptom and SAP recommended solution.
Description
Symptom
This SAP Security Note addresses a potential directory traversal vulnerability in the XX-CSC-BR-REP component. Through this vulnerability, a malicious user could write and delete arbitrary files on the remote server, potentially corrupting data or altering system behavior.
Solution
To resolve this issue, please implement the correction instructions provided in this note. Note 1497003 is a prerequisite and must be applied before implementing this security note. Refer to Note 1497003: Potential directory traversals in applications for details.
Full note on SAP: SAP Support Launchpad note 1598420
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].