Directory traversal vulnerability in SAP NetWeaver Application Server Java 7.5

SAP NetWeaver is a core component of the SAP software stack that serves as a foundation for other SAP components as well as JAVA and ABAP applications. Remote attackers can access arbitrary files through a (..)dot dot in the query string due to a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5.

Mitigation / Precaution

It is possible to mitigate the weakness using a firewall. If you are using SAP NetWeaver Application Server Java 7.5, You should update to the latest version.

Written by

Nash N Sulthan

Cyber Security Lead Engineer

Nash is a seasoned Security Engineer who brings a multifaceted approach to safeguarding digital environments. Not only does he excel in implementing robust security measures, but he's also deeply involved in the research and development process, constantly innovating to stay ahead of cyber threats. Nash's commitment to security extends beyond the conventional, making him a valuable contributor to the evolving landscape of digital defense.