Описание
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Ссылки
- Broken LinkThird Party AdvisoryVDB Entry
- Vendor Advisory
- ExploitThird Party Advisory
- Permissions Required
- ExploitThird Party AdvisoryVDB Entry
- Broken LinkThird Party AdvisoryVDB Entry
- Vendor Advisory
- ExploitThird Party Advisory
- Permissions Required
- ExploitThird Party AdvisoryVDB Entry
- US Government Resource
Уязвимые конфигурации
Одно из
EPSS
6.6 Medium
CVSS3
6.5 Medium
CVSS2
Дефекты
Связанные уязвимости
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
Уязвимость системы для управления взаимоотношениями с клиентами SAP Customer Relationship Management (CRM), связанная с неверным ограничением имени пути к каталогу с ограниченным доступом, позволяющая нарушителю выполнить произвольные команды
EPSS
6.6 Medium
CVSS3
6.5 Medium
CVSS2