CVE-2012-1289: Path Traversal

Published Feb 23, 2012

Updated

Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/logview.jsp in the Internet Sales (crm.b2b) component, or (3) ipc/admin/log.jsp or (4) ipc/admin/logview.jsp in the Application Administration (com.sap.ipc.webapp.ipc) component.

Affected Software

1 affected component

SAP NetWeaver=7.0

Event History

Feb 23, 2012

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-1289?

CVE-2012-1289 is rated as medium severity due to its potential for unauthorized file access.

How do I fix CVE-2012-1289?

To mitigate CVE-2012-1289, update SAP NetWeaver to the latest version that addresses this vulnerability.

Who is affected by CVE-2012-1289?

CVE-2012-1289 affects remote authenticated users of SAP NetWeaver 7.0.

What are the consequences of exploiting CVE-2012-1289?

Exploiting CVE-2012-1289 can lead to unauthorized access to sensitive files on the server.

What components of SAP NetWeaver are impacted by CVE-2012-1289?

CVE-2012-1289 impacts the log.jsp and log_view.jsp components in the b2b/admin and ipc/admin directories.