VYPR
← All advisories
Low severity3.5NVD Advisory· Published Dec 12, 2023· Updated Jun 17, 2026

CVE-2023-49058

CVE-2023-49058

Description

SAP Master Data Governance File Upload application allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing ‘traverse to parent directory’ are passed through to the file APIs. As a result, it has a low impact to the confidentiality.

Affected products

20
  • SAP/Master Data Governance19 versions
    cpe:2.3:a:sap:master_data_governance:731:*:*:*:*:*:*:*+ 18 more
    • cpe:2.3:a:sap:master_data_governance:731:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:732:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:746:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:747:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:748:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:749:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:751:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:752:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:800:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:801:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:802:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:803:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:804:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:805:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:806:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:807:*:*:*:*:*:*:*
    • cpe:2.3:a:sap:master_data_governance:808:*:*:*:*:*:*:*
    • (no CPE)
    • (no CPE)range: MDG_FND 731
  • SAP/Master Data Governance File Upload applicationllm-create

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.