PT-2015-2046 · Sap · Sap Mobile Platform+1

Vahagn Vardanyan · Published 2015-05-13 · Updated 2018-12-10 · CVE-2015-6664

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP Afaria (affected versions not specified) SAP Mobile Platform version 2.3

Description The issue allows a remote attacker to inject arbitrary JavaScript code by sending a specially crafted request to the Xcomms network service. Additionally, there is an XML external entity (XXE) vulnerability in the application import functionality, which enables remote attackers to read arbitrary files and possibly have other unspecified impact via crafted XML data.

Recommendations For SAP Afaria, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For SAP Mobile Platform version 2.3, consider restricting the application import functionality to minimize the risk of exploitation until a patch is available.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11392

CVE-2015-6664

Affected Products

Sap Afaria

Sap Mobile Platform

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2015-6664 · Security Note
• https://bdu.fstec.ru/vul/2015-11392 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6664 · Security Note
• http://erpscan.com/advisories/erpscan-15-007-sap-management-console-readprofile-parameters-information-disclosure · Note
• https://service.sap.com/sap/support/notes/2152669 · Note
• http://seclists.org/fulldisclosure/2015/Nov/96 · Note
• http://securityfocus.com/archive/1/536954/100/0/threaded · Note
• https://erpscan.io/advisories/erpscan-15-020-sap-mobile-platform-2-3-xxe-in-application-import · Note
• http://packetstormsecurity.com/files/134509/SAP-Mobile-Platform-2.3-XXE-Injection.html · Note