PT-2015-5907 · Sap · Sap Netweaver Portal

Vahagn Vardanyan · Published 2015-04-01 · Updated 2018-12-10 · CVE-2015-2812

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Portal version 7.31.201109172004

Description The issue allows remote attackers to send requests to intranet servers via crafted XML, exploiting an XML external entity (XXE) vulnerability in the XMLValidationComponent.

Recommendations For SAP NetWeaver Portal version 7.31.201109172004, apply the fix as described in SAP Security Note 2093966 to resolve the issue.

Fix

Related Identifiers

CVE-2015-2812

Affected Products

Sap Netweaver Portal

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-2812 · Security Note
• http://packetstormsecurity.com/files/132356/SAP-NetWeaver-Portal-7.31-XXE-Injection.html · Note
• https://erpscan.io/advisories/erpscan-15-004-sap-netweaver-portal-xmlvalidationcomponent-xxe · Note
• http://securityfocus.com/archive/1/535826/100/800/threaded · Note
• http://seclists.org/fulldisclosure/2015/Jun/62 · Note