BusinessObjects Enterprise Directory Traversal, SAP security note 1476930

SAP Note 1476930
SAP Security Note
High priority

SAP security note 1476930, "BusinessObjects Enterprise Directory Traversal", was released on October 12, 2010. Below are the symptom, SAP recommended solution and the affected software components.

ComponentBusiness Intelligence Solutions > Business Intelligence Platform > Obsolete – Performance Manager, Metrics

PriorityHigh priority

TypeSAP Security Note

StatusReleased for Customer

Released onOctober 12, 2010

Description

Symptom

A vulnerability exists in the Business Objects InfoView web portal that allows a malicious user to perform directory traversal. This can enable unauthorized reading of arbitrary files on the remote server, potentially disclosing confidential information.

Solution

Customers should install FixPack 2.9 or FixPack 3.1 to address this vulnerability.

Reason and prerequisites

The InfoView web portal does not properly validate the file paths used when accessing files on the remote server. This flaw allows an attacker to manipulate the file path to access arbitrary files, leading to potential exposure of sensitive data.

Affected components

BOEWEBAPPJAVA (3.1)

Full note on SAP: SAP Support Launchpad note 1476930

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Business Intelligence Platform #Performance Manager #Metrics