PT-2016-7330 · Sap · Sap Netweaver

Emiliano J. Fausto · Published 2016-10-13 · Updated 2016-10-13 · CVE-2016-7437

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP Netweaver version 7.40

Description The issue allows local users to potentially hide rejected attempts to execute RFC function callbacks by improperly logging certain events as non-critical in the SAP Security Audit Log. This could be leveraged by filtering of non-critical events in audit analysis reports.

Recommendations For SAP Netweaver version 7.40, apply the fix provided in SAP Security Note 2252312 to properly log events and prevent potential hiding of rejected attempts to execute RFC function callbacks.

Fix

Related Identifiers

CVE-2016-7437

Affected Products

Sap Netweaver

References · 5

• https://osv.dev/vulnerability/CVE-2016-7437 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7437 · Security Note
• https://onapsis.com/research/security-advisories/sap-business-objects-memory-corruption-0 · Note
• http://securityfocus.com/bid/93503 · Note
• http://seclists.org/fulldisclosure/2016/Oct/53 · Note