PT-2014-8461 · Sap · Sap Netweaver As Abap

Published 2014-10-16 · Updated 2022-10-06 · CVE-2014-8312

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP Netweaver AS ABAP version 7.31

Description The issue allows remote authenticated users to obtain sensitive information by making a request to the RSDU CCMS GET PROFILE PARAM RFC function.

Recommendations For SAP Netweaver AS ABAP version 7.31, consider restricting access to the RSDU CCMS GET PROFILE PARAM RFC function until a patch is available.

Fix

Related Identifiers

CVE-2014-8312

Affected Products

Sap Netweaver As Abap

References · 10

• https://service.sap.com/sap/support/notes/1967780 · Vendor Advisory
• http://scn.sap.com/docs/DOC-8218 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-8312 · Security Note
• http://packetstormsecurity.com/files/128603/SAP-Business-Warehouse-Missing-Authorization-Check.html · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/96877 · Note
• http://securityfocus.com/bid/70292 · Note
• http://securityfocus.com/archive/1/533645/100/0/threaded · Note
• http://secunia.com/advisories/61101 · Note
• http://seclists.org/fulldisclosure/2014/Oct/38 · Note
• http://onapsis.com/resources/get.php?resid=adv_onapsis-2014-033 · Note