PT-2012-3179 · Sap · Sap Netweaver

Published 2012-02-23 · Updated 2012-02-24 · CVE-2012-1291

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver version 7.0

Description The issue allows remote attackers to obtain sensitive information about the Adapter Monitor via unspecified vectors, possibly related to the EnableInvokerServletGlobally property in the servlet jsp service.

Recommendations For SAP NetWeaver version 7.0, consider restricting access to the com.sap.aii.mdt.amt.web.AMTPageProcessor servlet until a fix is available. Additionally, review the configuration of the EnableInvokerServletGlobally property in the servlet jsp service to minimize potential exposure.

Fix

Related Identifiers

CVE-2012-1291

Affected Products

Sap Netweaver

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2012-1291 · Security Note
• http://secunia.com/advisories/47861 · Vendor Advisory
• https://service.sap.com/sap/support/notes/1585527 · Note
• http://dsecrg.com/pages/vul/show.php?id=415 · Note
• http://sdn.sap.com/irj/sdn/index?rid=/webcontent/uuid/c05604f6-4eb3-2d10-eea7-ceb666083a6a · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1291 · Note
• http://securityfocus.com/bid/52101 · Note