PT-2015-5906 · Sap · Sap Netweaver Portal

Vahagn Vardanyan · Publicado 2015-04-01 · Atualizado 2018-12-10 · CVE-2015-2811

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Portal version 7.31.201109172004

Description The issue allows remote attackers to send requests to intranet servers via crafted XML. This is related to an XML external entity (XXE) vulnerability in ReportXmlViewer.

Recommendations For SAP NetWeaver Portal version 7.31.201109172004, apply the fix as described in SAP Security Note 2111939 to resolve the issue.

Correção

Identificadores relacionados

CVE-2015-2811

Produtos afetados

Sap Netweaver Portal

Referências · 6

• http://packetstormsecurity.com/files/132358/SAP-NetWeaver-Portal-7.31-XXE-Injection.html · Nota
• https://erpscan.io/advisories/erpscan-15-006-sap-netweaver-portal-reportxmlviewer-xxe · Nota
• http://securityfocus.com/bid/73691 · Nota
• http://securityfocus.com/archive/1/535827/100/800/threaded · Nota
• http://seclists.org/fulldisclosure/2015/Jun/64 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-2811 · Nota de Segurança