PT-2017-16459 · Sap · Sap As Java

Publicado 2017-01-23 · Atualizado 2018-12-10 · CVE-2017-5372

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP AS JAVA (affected versions not specified)

Description The issue allows remote attackers to obtain sensitive system information due to a missing authorization check in the msp function, also known as MSPRuntimeInterface, within the P4 SERVERCORE component. This affects the following functions: getInformation, getParameters, getServiceInfo, getStatistic, and getClientStatistic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-5372

Produtos afetados

Sap As Java

Referências · 6

• http://packetstormsecurity.com/files/140611/SAP-NetWeaver-AS-Java-P4-MSPRUNTIMEINTERFACE-Information-Disclosure.html · Nota
• http://securityfocus.com/bid/93504 · Nota
• http://seclists.org/fulldisclosure/2017/Jan/50 · Nota
• https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-october-2016 · Nota
• https://erpscan.io/advisories/erpscan-16-037-sap-java-p4-mspruntimeinterface-information-disclosure · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5372 · Nota de Segurança