PT-2018-15599 · Sap · Sap Disclosure Management

Published 2018-11-13 · Updated 2020-08-24 · CVE-2018-2487

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Disclosure Management versions 10.x

Description The issue allows an attacker to exploit the system through a specially crafted zip file provided by users. When extracted in specific use cases, files within this zip file can land in different locations than the originally intended extraction point.

Recommendations For SAP Disclosure Management versions 10.x, consider validating and sanitizing user-provided zip files to prevent malicious files from being extracted to unintended locations. As a temporary workaround, restrict the ability of users to upload zip files until a proper fix is available.

Fix

Related Identifiers

CVE-2018-2487

Affected Products

Sap Disclosure Management

References · 5

• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=503809832 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-2487 · Security Note
• https://launchpad.support.sap.com/#/notes/2701410 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-2487 · Vendor Advisory
• http://securityfocus.com/bid/105908 · Note