CVE-2006-0732

Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName…

published February 16, 2006

CVSS
—
EPSS
3%
Percentile
84.8
In the wild
Unconfirmed
What it is

Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName parameter to (1) sapbc/SAP/chopSAPLog.dsp or (2) invoke/sap.monitor.rfcTrace/deleteSingle. Details will be updated after the grace period has ended. NOTE: SAP Business Connector is an OEM version of webMethods Integration Server. webMethods states that this issue can only occur when the product is installed as root/admin, and if the attacker has access to a general purpose port; however, both are discouraged in the documentation. In addition, the attacker must already have acquired administrative privileges through other means.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02542 · 84.8th percentile
Published
2006-02-16T11:00Z
EPSS history
Timeline
  • 16 FEB 11:00Z
    Directory traversal vulnerability in SAP Business Connector (BC) 4.6 and 4.7 allows remote attackers to read or delete arbitrary files via the fullName…
    cvelistv5