PT-2018-15599 · Sap · Sap Disclosure Management

Publicado 2018-11-13 · Atualizado 2020-08-24 · CVE-2018-2487

Positive Technologies (AI Summary)

CVSS v3.1

8.3

Alta

Vetor base

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Disclosure Management versions 10.x

Description The issue allows an attacker to exploit the system through a specially crafted zip file provided by users. When extracted in specific use cases, files within this zip file can land in different locations than the originally intended extraction point.

Recommendations For SAP Disclosure Management versions 10.x, consider validating and sanitizing user-provided zip files to prevent malicious files from being extracted to unintended locations. As a temporary workaround, restrict the ability of users to upload zip files until a proper fix is available.

Correção

Identificadores relacionados

CVE-2018-2487

Produtos afetados

Sap Disclosure Management

Referências · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-2487 · Nota de Segurança
• https://launchpad.support.sap.com/#/notes/2701410 · Aviso do Fabricante
• http://securityfocus.com/bid/105908 · Nota
• https://osv.dev/vulnerability/CVE-2018-2487 · Aviso do Fabricante