PT-2015-3186 · Sap · Sap Mobile Platform 3

Vahagn Vardanyan · Published 2015-06-24 · Updated 2018-12-10 · CVE-2015-5068

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions SAP Mobile Platform 3

Description The issue is related to an XML external entity (XXE) vulnerability, which allows remote attackers to read arbitrary files or possibly have other unspecified impact via a crafted XML request. This is due to incorrect restriction of XML external entity references. The vulnerability can be exploited by a remote attacker using a specially crafted XML request, potentially allowing them to read arbitrary files.

Recommendations For SAP Mobile Platform 3, consider restricting or disabling the processing of external XML entities to minimize the risk of exploitation until a fix is available. As a temporary workaround, avoid using XML requests that could potentially trigger the vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XXE

Weakness Enumeration

CWE-611

Related Identifiers

BDU:2016-00556

CVE-2015-5068

Affected Products

Sap Mobile Platform 3

References · 8

• http://scn.sap.com/community/security/blog/2015/06/11/sap-security-notes-june-2015 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5068 · Security Note
• https://bdu.fstec.ru/vul/2016-00556 · Security Note
• http://packetstormsecurity.com/files/133514/SAP-Mobile-Platform-3-XXE-Injection.html · Note
• http://erpscan.com/advisories/erpscan-15-015-sap-netweaver-hardcoded-credentials · Note
• https://erpscan.io/advisories/erpscan-15-014-sap-mobile-platform-3-xxe-in-add-repository · Note
• http://seclists.org/fulldisclosure/2015/Sep/36 · Note
• http://securityfocus.com/bid/75166 · Note