← Back

CVE-2023-49058

nvd nist
Published: Dec 12, 2023Modified: Nov 21, 2024

JSON object

Loading...
5.3
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Exploitability: 3.9 / Impact: 1.4
Source: NVD

Description

SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality.

Affected (17)

Sap
1 product
Master Data Governance
Configuration A
17 vulnerable
Vulnerable SoftwareAffected Versions
Sap
Master Data Governance
Version 731
Master Data Governance
Version 732
Master Data Governance
Version 746
Master Data Governance
Version 747
Master Data Governance
Version 748
Master Data Governance
Version 749
Master Data Governance
Version 751
Master Data Governance
Version 752
Master Data Governance
Version 800
Master Data Governance
Version 801
Master Data Governance
Version 802
Master Data Governance
Version 803
Master Data Governance
Version 804
Master Data Governance
Version 805
Master Data Governance
Version 806
Master Data Governance
Version 807
Master Data Governance
Version 808

Related CWEs

CWE-22
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

References (4)

Source: cna@sap.com
Permissions Required
Source: cna@sap.com
Vendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Permissions Required
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory

Timeline

No history available yet.