PT-2016-7330 · Sap · Sap Netweaver

Emiliano J. Fausto · Publicado 2016-10-13 · Atualizado 2016-10-13 · CVE-2016-7437

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Baixa

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Netweaver version 7.40

Description The issue allows local users to potentially hide rejected attempts to execute RFC function callbacks by improperly logging certain events as non-critical in the SAP Security Audit Log. This could be leveraged by filtering of non-critical events in audit analysis reports.

Recommendations For SAP Netweaver version 7.40, apply the fix provided in SAP Security Note 2252312 to properly log events and prevent potential hiding of rejected attempts to execute RFC function callbacks.

Correção

Identificadores relacionados

CVE-2016-7437

Produtos afetados

Sap Netweaver

Referências · 5

• https://onapsis.com/research/security-advisories/sap-business-objects-memory-corruption-0 · Nota
• https://osv.dev/vulnerability/CVE-2016-7437 · Aviso do Fabricante
• http://securityfocus.com/bid/93503 · Nota
• http://seclists.org/fulldisclosure/2016/Oct/53 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-7437 · Nota de Segurança