PT-2018-15500 · Sap · Sap Basis

Published 2018-03-01 · Updated 2018-03-23 · CVE-2018-2367

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP BASIS versions 7.00 through 7.02 SAP BASIS versions 7.10 through 7.11 SAP BASIS version 7.30 SAP BASIS version 7.31 SAP BASIS version 7.40 SAP BASIS versions 7.50 through 7.52

Description The issue allows an attacker to exploit insufficient validation of path information provided by users. This can lead to characters representing "traverse to parent directory" being passed through to the file APIs, potentially allowing unauthorized access to files.

Recommendations For SAP BASIS versions 7.00 through 7.02, update to a version outside of this range to resolve the issue. For SAP BASIS versions 7.10 through 7.11, update to a version outside of this range to resolve the issue. For SAP BASIS version 7.30, update to a version outside of this range to resolve the issue. For SAP BASIS version 7.31, update to a version outside of this range to resolve the issue. For SAP BASIS version 7.40, update to a version outside of this range to resolve the issue. For SAP BASIS versions 7.50 through 7.52, update to a version outside of this range to resolve the issue. As a temporary workaround, consider restricting access to the ABAP File Interface to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-2367

Affected Products

Sap Basis

References · 5

• https://blogs.sap.com/2018/02/13/sap-security-patch-day-february-2018 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2367 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2367 · Security Note
• https://launchpad.support.sap.com/#/notes/2562089 · Note
• http://securityfocus.com/bid/103006 · Note