SAP security note 1606787, "HR-RU: Potential Directory Traversal", is a note. Below are the symptom, SAP recommended solution and the affected software components.
Description
Symptom
SAP Security Note 1606787 addresses a potential directory traversal vulnerability in the HR-RU reports. This vulnerability allows a malicious user to write arbitrary files on the remote server, which could lead to data corruption or alteration of system behavior.
Solution
To mitigate this vulnerability, implement the corrections as described in the correction instructions attached to this note or import the relevant HR Support Package for your system.
Reason and prerequisites
Before applying this note, ensure that SAP Note 1497003 is applied. The corrections from Note 1497003 are required.
References
Affected components
- SAP_HRCRU Release 600
- SAP_HRCRU Release 604
- EA-HRCRU Release 605
Full note on SAP: SAP Support Launchpad note 1606787
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].