PT-2015-3186 · Sap · Sap Mobile Platform 3

Vahagn Vardanyan · Publicado 2015-06-24 · Atualizado 2018-12-10 · CVE-2015-5068

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP Mobile Platform 3

Description The issue is related to an XML external entity (XXE) vulnerability, which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request. This is due to incorrect restriction of XML external entity references. The vulnerability can be exploited by a remote attacker using a specially crafted XML request, potentially allowing them to read arbitrary files.

Recommendations For SAP Mobile Platform 3, consider restricting or disabling the processing of external XML entities to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using XML requests that could potentially trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

BDU:2016-00556

CVE-2015-5068

Produtos afetados

Sap Mobile Platform 3

Referências · 8

• http://packetstormsecurity.com/files/133514/SAP-Mobile-Platform-3-XXE-Injection.html · Nota
• http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015 · Aviso do Fabricante
• http://erpscan.com/advisories/erpscan-15-015-sap-netweaver-hardcoded-credentials · Nota
• https://erpscan.io/advisories/erpscan-15-014-sap-mobile-platform-3-xxe-in-add-repository · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-5068 · Nota de Segurança
• http://seclists.org/fulldisclosure/2015/Sep/36 · Nota
• https://bdu.fstec.ru/vul/2016-00556 · Nota de Segurança
• http://securityfocus.com/bid/75166 · Nota