PT-2015-5201 · Sap · Sap Netweaver As Abap

Published 2015-01-22 · Updated 2022-10-06 · CVE-2015-1309

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS ABAP versions 7.31 and earlier

Description The issue allows remote attackers to access arbitrary files via a crafted XML request. This is related to the ECATT DISPLAY XMLSTRING REMOTE function.

Recommendations For SAP NetWeaver AS ABAP versions 7.31 and earlier, apply the fix provided in SAP Note 2016638 to resolve the issue.

Fix

Related Identifiers

CVE-2015-1309

Affected Products

Sap Netweaver As Abap

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2015-1309 · Security Note
• https://erpscan.io/advisories/erpscan-15-001-sap-netweaver-ecatt_display_xmlstring_remote-xxe · Note
• https://erpscan.io/press-center/blog/sap-critical-patch-update-january-2015 · Note
• http://secunia.com/advisories/62469 · Note