PT-2016-7834 · Sap+1 · Sap Internet Communication Framework+3

Ertunga Arsal + 1 · Publicado 2016-12-09 · Atualizado 2018-10-09 · CVE-2016-9832

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PricewaterhouseCoopers (PwC) ACE-ABAP version 8.10.304 for SAP Security

Description The issue allows remote authenticated users to conduct ABAP injection attacks and execute arbitrary code. This can be achieved via SAPGUI or Internet Communication Framework (ICF) over HTTP or HTTPS. Examples of exploitation include using WEBGUI or Report.

Recommendations For PricewaterhouseCoopers (PwC) ACE-ABAP version 8.10.304, consider restricting access to the SAPGUI and Internet Communication Framework (ICF) to minimize the risk of exploitation. As a temporary workaround, limit the use of WEBGUI and Report until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2016-9832

Produtos afetados

Ace-Abap

Sap Internet Communication Framework

Sap Gui

Webgui

Referências · 8

• 🔥 http://packetstormsecurity.com/files/140062/PwC-ACE-Software-For-SAP-Security-8.10.304-ABAP-Injection.html · Exploit
• http://securityfocus.com/bid/94733 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-9832 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2016-9832 · Aviso do Fabricante
• https://esnc.de/security-advisories/vulnerability-in-pwc-ace-for-sap-security · Nota
• http://securityfocus.com/archive/1/539883/100/0/threaded · Nota
• http://seclists.org/fulldisclosure/2016/Dec/33 · Nota
• http://securityfocus.com/archive/1/539883/30/0/threaded · Nota