CVE-2017-11459: Code Injection
Published Jul 25, 2017
·Updated
SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command, aka SAP Security Note 2419592.
Affected Software
1 affected component
SAP TREX=7.10
Event History
Jul 25, 2017
CVE Published
via MITRE·06:00 PM
Data Sourced
via MITRE·06:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2017-11459?
CVE-2017-11459 has a critical severity level as it allows remote code execution.
2
How do I fix CVE-2017-11459?
To fix CVE-2017-11459, you should apply the patches provided in SAP Security Note 2419592.
3
What software versions are affected by CVE-2017-11459?
CVE-2017-11459 affects SAP TREX version 7.10.
4
What types of attacks can be executed through CVE-2017-11459?
CVE-2017-11459 allows attackers to read arbitrary files and write to arbitrary files, potentially executing arbitrary code.
5
Is there a workaround for CVE-2017-11459 if I cannot apply the patch?
There are no official workarounds for CVE-2017-11459; applying the patch is the recommended mitigation.