PT-2018-1589 · Sap · Sap Netweaver

Publicado 2018-09-11 · Atualizado 2018-11-26 · CVE-2018-2462

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP NetWeaver BI versions 7.30 through 7.50

Description The issue is related to the BEx Web Java Runtime Export Web Service in SAP NetWeaver BI, which does not sufficiently validate an XML document accepted from an untrusted source. This is due to incorrect restriction of XML links to external objects, allowing a remote attacker to potentially gain access to the file system or cause a denial of service.

Recommendations For SAP NetWeaver BI versions 7.30 through 7.50, consider restricting access to the BEx Web Java Runtime Export Web Service until a fix is available, and ensure proper validation of XML documents from untrusted sources to prevent potential exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

RCE

Enumeração de Fraquezas

CWE-611

CWE-20

Identificadores relacionados

BDU:2018-01146

CVE-2018-2462

Produtos afetados

Sap Netweaver

Referências · 8

• http://securityfocus.com/bid/105326 · Nota
• https://wiki.scn.sap.com/wiki/pages/viewpage.action?pageId=499356993 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2018-01146 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-2462 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-2462 · Aviso do Fabricante
• https://securityfocus.com/bid/105326/info · Nota
• https://launchpad.support.sap.com/#/notes/2644279 · Aviso do Fabricante
• https://threatpost.ru/sap-patched-14-vulnerabilities-in-its-products/28202 · Nota