PT-2016-1283 · Sap · Sap Netweaver+1
Dmitry Chastuhin
·
Published
2016-02-16
·
Updated
2018-12-10
·
CVE-2016-2389
CVSS v2.0
7.8
High
| Vector | AV:N/AC:L/Au:N/C:C/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
SAP NetWeaver versions 7.4
SAP Manufacturing Integration and Intelligence (xMII) component version 15.0
Description
The issue is related to a directory traversal vulnerability in the SAP Manufacturing Integration and Intelligence (xMII) component. This vulnerability allows a remote attacker to read arbitrary files by exploiting weaknesses in path name restrictions. The vulnerability can be exploited through the
GetFileList function by using a .. (dot dot) in the Path parameter to the "/Catalog" endpoint.Recommendations
For SAP NetWeaver version 7.4 with the SAP Manufacturing Integration and Intelligence (xMII) component version 15.0, consider restricting access to the
GetFileList function until a patch is available.
As a temporary workaround, avoid using the Path parameter in the "/Catalog" endpoint to minimize the risk of exploitation.Exploit
Fix
Path traversal
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Sap Manufacturing Integration/Intelligence
Sap Netweaver