Vulnerability Description
Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591.
CVSS Score
9.8
CRITICAL
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Sap | Trex | 7.10 |
Related Weaknesses (CWE)
References
- http://packetstormsecurity.com/files/138437/SAP-TREX-7.10-Revision-63-Directory-
- http://scn.sap.com/community/security/blog/2015/10/14/sap-security-notes-octoberVendor Advisory
- http://seclists.org/fulldisclosure/2016/Aug/114
- http://seclists.org/fulldisclosure/2016/Aug/86
- http://www.securityfocus.com/bid/92060Third Party AdvisoryVDB Entry
- https://layersevensecurity.com/wp-content/uploads/2015/11/Layer-Seven-Security_STechnical Description
- https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
- https://www.onapsis.com/research/security-advisories/sap-trex-remote-directory-tPermissions Required
- http://packetstormsecurity.com/files/138437/SAP-TREX-7.10-Revision-63-Directory-
- http://scn.sap.com/community/security/blog/2015/10/14/sap-security-notes-octoberVendor Advisory
- http://seclists.org/fulldisclosure/2016/Aug/114
- http://seclists.org/fulldisclosure/2016/Aug/86
- http://www.securityfocus.com/bid/92060Third Party AdvisoryVDB Entry
- https://layersevensecurity.com/wp-content/uploads/2015/11/Layer-Seven-Security_STechnical Description
- https://www.onapsis.com/blog/analyzing-sap-security-notes-october-2015
FAQ
What is CVE-2016-6138?
CVE-2016-6138 is a vulnerability with a CVSS score of 9.8 (CRITICAL). Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591.
How severe is CVE-2016-6138?
CVE-2016-6138 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2016-6138?
Check the references section above for vendor advisories and patch information. Affected products include: Sap Trex.