PT-2014-2697 · Sap · Sap Governance

Ertunga Arsal + 1 · Published 2014-11-17 · Updated 2018-10-09 · CVE-2013-3678

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SAP Governance, Risk, and Compliance (GRC) (affected versions not specified)

Description The issue allows remote authenticated users to gain privileges and execute arbitrary programs. This can be achieved by sending a crafted request, either via RFC or SOAP-RFC.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2013-3678

Affected Products

Sap Governance

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2013-3678 · Security Note
• http://packetstormsecurity.com/files/129083/SAP-GRC-Bypass-Privilege-Escalation-Program-Execution.html · Note
• http://securityfocus.com/bid/71055 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/98637 · Note
• http://seclists.org/fulldisclosure/2014/Nov/25 · Note
• https://service.sap.com/sap/support/notes/2039348 · Note
• http://esnc.de/security-advisories/security-vulnerability-in-sap-grc-access-control · Note
• http://securityfocus.com/archive/1/533965/100/0/threaded · Note