PT-2013-6160 · Sap · Sap Netweaver

Publicado 2013-11-23 · Atualizado 2018-12-10 · CVE-2013-6869

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.30

Description A SQL injection issue in the SRTT GET COUNT BEFORE KEY RFC function allows remote attackers to execute arbitrary SQL commands.

Recommendations For SAP NetWeaver version 7.30, consider restricting access to the SRTT GET COUNT BEFORE KEY RFC function until a patch is available.

Correção

RCE

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2013-6869

Produtos afetados

Sap Netweaver

Referências · 7

• http://scn.sap.com/docs/DOC-8218 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-6869 · Nota
• https://service.sap.com/sap/support/notes/1783795 · Nota
• http://secunia.com/advisories/55736 · Aviso do Fabricante
• https://erpscan.io/advisories/erpscan-13-017-sap-netweaver-srtt_get_count_before_key_rfc-sql-injection · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2013-6869 · Nota de Segurança
• http://securitytracker.com/id/1029352 · Nota