CVE-2012-1289 Path traversal in n/a
Authenticated attackers can read arbitrary files on SAP NetWeaver servers via directory traversal in log viewing components.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2012-1289?
CVE-2012-1289 is a medium-severity path traversal vulnerability in Sap Netweaver, published on 23 Feb 2012. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Multiple directory traversal vulnerabilities in SAP NetWeaver 7.0 allow remote authenticated users to read arbitrary files via a .. (dot dot) in the logfilename parameter to (1) b2b/admin/log.jsp or (2) b2b/admin/log_view.jsp in the Internet Sales (crm.b2b) component, or (3) ipc/admin/log.jsp or (4) ipc/admin/log_view.jsp in the Application Administration (com.sap.ipc.webapp.ipc) component.
Weakness: CWE-22
Which versions are affected by CVE-2012-1289?
It affects 1 product.
Products include Sap Netweaver.
How do I fix CVE-2012-1289?
No fix has been published for CVE-2012-1289 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2012-1289 being exploited?
There is no known exploitation of CVE-2012-1289 in the wild and no public exploit code.
Other vulnerabilities in Sap Netweaver
Sources
Also known as GHSA-p6qx-67x2-357p.