Описание
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
Ссылки
- https://nvd.nist.gov/vuln/detail/CVE-2016-3976
- https://erpscan.io/advisories/erpscan-16-012
- https://erpscan.io/press-center/blog/sap-security-notes-march-2016-review
- https://launchpad.support.sap.com/#/notes/2234971
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3976
- https://www.exploit-db.com/exploits/39996
- http://packetstormsecurity.com/files/137528/SAP-NetWeaver-AS-JAVA-7.5-Directory-Traversal.html
- http://seclists.org/fulldisclosure/2016/Jun/40
Связанные уязвимости
Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.
Уязвимость сервера веб-приложений SAP NetWeaver Java Application Server, связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю получить несанкционированный доступ к защищаемой информации