CVE-2012-1289

SAP NetWeaver 7.0 - Authenticated Path Traversal via Logfilename Parameter

Title source: llm
STIX 2.1

Description

Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3) ipc/admin/log.jsp or (4) ipc/admin/log_view.jsp in the Application Administration (com.sap.ipc.webapp.ipc) component.

References (7)

Core 7
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/52101
Third Party Advisory, VDB Entry vdb-entry x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/73346
Various Sources x_refsource_misc
https://service.sap.com/sap/support/notes/1585527
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/47861

Scores

EPSS 0.0049
EPSS Percentile 65.7%

Details

CWE
CWE-22
Status published
Products (1)
sap/netweaver 7.0
Published Feb 23, 2012
Tracked Since Feb 18, 2026