SAP Solution Manager Directory Traversal Vulnerability Allowing Unauthorized Access to Critical Information

A directory traversal vulnerability has been identified in SAP Solution Manager, allowing authorized attackers to access sensitive information. Exploitation involves using an RFC-enabled function module to read files from any managed system connected to SAP Solution Manager. This vulnerability has a high impact on confidentiality, with no effects on integrity or availability.

Impact

Successful exploitation allows unauthorized access to critical information, with a high impact on confidentiality.

Remediation

Users are advised to review and implement the SAP Security Note associated with this vulnerability. This can be done through the SAP Security Patch Day, which occurs on the second Tuesday of every month. For more information, consult the SAP Security Notes FAQ.