CVEvulnerability

CVE-2023-49058

5.3 MEDIUM Published 2023-12-12 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2023-12-12
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
3.5 LOW — CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-22

Description

SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality.

Affected configurations

• sap master data governance 731 • sap master data governance 732 • sap master data governance 746 • sap master data governance 747 • sap master data governance 748 • sap master data governance 749 • sap master data governance 751 • sap master data governance 752 • sap master data governance 800 • sap master data governance 801 • sap master data governance 802 • sap master data governance 803 • sap master data governance 804 • sap master data governance 805 • sap master data governance 806 • sap master data governance 807 • sap master data governance 808

Related

Weakness · CWE (1)

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness

References