Riskcovery

CVE-2023-49058

Directory Traversal vulnerability in SAP Master Data Governance

State
Published
Severity
3.5 Low
Published
Dec 12, 2023
Updated
Aug 2, 2024
Reserved
Nov 20, 2023

Read the record on cve.org

Description

SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality.

Scores

CVSSScoreVectorSource
3.13.5 LowCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:Nsap

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal)

Affected Products

ProductVersions
SAP Master Data GovernanceSAP_SE
  • MDG_FND 731Affected
  • MDG_FND 732Affected
  • MDG_FND 746Affected
  • MDG_FND 747Affected
  • MDG_FND 748Affected
  • MDG_FND 749Affected
  • MDG_FND 752Affected
  • MDG_FND 800Affected
  • MDG_FND 802Affected
  • MDG_FND 803Affected
  • MDG_FND 804Affected
  • MDG_FND 805Affected
  • MDG_FND 806Affected
  • MDG_FND 807Affected
  • MDG_FND 808Affected
  • SAP_BS_FND 702Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.