PT-2015-5201 · Sap · Sap Netweaver As Abap

CVE-2015-1309 · Publicado 2015-01-22 · Atualizado 2022-10-06

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP versions 7.31 and earlier

Description The issue allows remote attackers to access arbitrary files via a crafted XML request. This is related to the ECATT DISPLAY XMLSTRING REMOTE function.

Recommendations For SAP NetWeaver AS ABAP versions 7.31 and earlier, apply the fix provided in SAP Note 2016638 to resolve the issue.

Correção

Identificadores relacionados

CVE-2015-1309

Produtos afetados

Sap Netweaver As Abap

Referências · 4

• https://erpscan.io/advisories/erpscan-15-001-sap-netweaver-ecatt_display_xmlstring_remote-xxe · Nota
• https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1309 · Nota de Segurança
• http://secunia.com/advisories/62469 · Nota