CVEvulnerability

CVE-2001-0366

7.2 HIGH Published 2001-06-27 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2001-06-27
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

saposcol in SAP R/3 Web Application Server Demo before 1.5 trusts the PATH environmental variable to find and execute the expand program, which allows local users to obtain root access by modifying the PATH to point to a Trojan horse expand program.

Affected configurations

• sap sap r 3 web application server demo (<= 1.5) • sap saposcol 1.0 • sap saposcol 1.1 • sap saposcol 1.2 • sap saposcol 1.3

References