PT-2016-1283 · Sap · Sap Netweaver+1
Dmitry Chastuhin
·
Publicado
2016-02-16
·
Atualizado
2018-12-10
·
CVE-2016-2389
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SAP NetWeaver versions 7.4
SAP Manufacturing Integration and Intelligence (xMII) component version 15.0
Description
The issue is related to a directory traversal vulnerability in the SAP Manufacturing Integration and Intelligence (xMII) component. This vulnerability allows a remote attacker to read arbitrary files by exploiting weaknesses in path name restrictions. The vulnerability can be exploited through the
GetFileList function by using a .. (dot dot) in the Path parameter to the "/Catalog" endpoint.Recommendations
For SAP NetWeaver version 7.4 with the SAP Manufacturing Integration and Intelligence (xMII) component version 15.0, consider restricting access to the
GetFileList function until a patch is available.
As a temporary workaround, avoid using the Path parameter in the "/Catalog" endpoint to minimize the risk of exploitation.Exploit
Correção
Path traversal
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Sap Manufacturing Integration/Intelligence
Sap Netweaver