PT-2017-14521 · Sap · Sap Netweaver Internet Transaction Server

Publicado 2017-12-12 · Atualizado 2017-12-22 · CVE-2017-16682

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Internet Transaction Server (ITS) versions 7.00 through 7.02 SAP NetWeaver Internet Transaction Server (ITS) version 7.30 SAP NetWeaver Internet Transaction Server (ITS) version 7.31 SAP NetWeaver Internet Transaction Server (ITS) version 7.40 SAP NetWeaver Internet Transaction Server (ITS) versions 7.50 through 7.52

Description The issue allows an attacker with administrator credentials to inject code that can be executed by the application, thereby controlling the behavior of the application.

Recommendations For SAP NetWeaver Internet Transaction Server (ITS) versions 7.00 through 7.02, update to a version outside of this range to mitigate the risk. For SAP NetWeaver Internet Transaction Server (ITS) version 7.30, update to a version outside of this range to mitigate the risk. For SAP NetWeaver Internet Transaction Server (ITS) version 7.31, update to a version outside of this range to mitigate the risk. For SAP NetWeaver Internet Transaction Server (ITS) version 7.40, update to a version outside of this range to mitigate the risk. For SAP NetWeaver Internet Transaction Server (ITS) versions 7.50 through 7.52, update to a version outside of this range to mitigate the risk.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2017-16682

Produtos afetados

Sap Netweaver Internet Transaction Server

Referências · 5

• http://securityfocus.com/bid/102143 · Nota
• https://osv.dev/vulnerability/CVE-2017-16682 · Aviso do Fabricante
• https://launchpad.support.sap.com/#/notes/2526781 · Nota
• https://blogs.sap.com/2017/12/12/sap-security-patch-day-december-2017 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-16682 · Nota de Segurança