PT-2016-1283 · Sap · Sap Netweaver+1

Dmitry Chastuhin

·

Published

2016-02-16

·

Updated

2018-12-10

·

CVE-2016-2389

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions SAP NetWeaver versions 7.4 SAP Manufacturing Integration and Intelligence (xMII) component version 15.0
Description The issue is related to a directory traversal vulnerability in the SAP Manufacturing Integration and Intelligence (xMII) component. This vulnerability allows a remote attacker to read arbitrary files by exploiting weaknesses in path name restrictions. The vulnerability can be exploited through the GetFileList function by using a .. (dot dot) in the Path parameter to the "/Catalog" endpoint.
Recommendations For SAP NetWeaver version 7.4 with the SAP Manufacturing Integration and Intelligence (xMII) component version 15.0, consider restricting access to the GetFileList function until a patch is available. As a temporary workaround, avoid using the Path parameter in the "/Catalog" endpoint to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2016-00580
CVE-2016-2389

Affected Products

Sap Manufacturing Integration/Intelligence
Sap Netweaver