PT-2016-6012 · Sap · Sap Netweaver 2004S

Sergio Abraham · Published 2016-10-05 · Updated 2016-11-28 · CVE-2016-4551

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver 2004s versions 7.00 SP Level 0031

Description The issue might allow remote attackers to spoof IP addresses written to the Security Audit Log via vectors related to the network landscape.

Recommendations For SAP NetWeaver 2004s version 7.00 SP Level 0031, apply the fix as described in SAP Security Note 2190621 to resolve the issue.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2016-4551

Affected Products

Sap Netweaver 2004S

References · 5

• https://osv.dev/vulnerability/CVE-2016-4551 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-4551 · Security Note
• https://onapsis.com/research/security-advisories/sap-security-audit-log-invalid-address-logging · Note
• http://securityfocus.com/bid/93288 · Note
• http://seclists.org/fulldisclosure/2016/Oct/3 · Note