Path Traversal in SAP Master Data Governance
CVE-2023-49058
SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality.
Vulnerability class: Path Traversal (Directory Traversal)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N.
EPSS exploit prediction
EPSS: 0.006 (47.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 48th percentile — 47.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.006 · change: 0.000
Affected products
- SAP Master Data Governance — versions 731, 732, 746
- SAP Se Master Data Governance — versions MDG_FND 731, MDG_FND 732, MDG_FND 746
Weakness classification (CWE)
References
- me.sap.com/notes/3363690 (Permissions Required)
- www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html (Vendor Advisory)
Frequently asked questions
- What is CVE-2023-49058?
- CVE-2023-49058 is a low-severity vulnerability in SAP Master Data Governance, classified under Path Traversal. CVSS score: 3.5/10. Published 2023-12-12.
- How severe is CVE-2023-49058?
- Low severity. CVSS v3 base score is 3.5 out of 10.