PT-2017-16459 · Sap · Sap As Java

Published 2017-01-23 · Updated 2018-12-10 · CVE-2017-5372

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions SAP AS JAVA (affected versions not specified)

Description The issue allows remote attackers to obtain sensitive system information due to a missing authorization check in the msp function, also known as MSPRuntimeInterface, within the P4 SERVERCORE component. This affects the following functions: getInformation, getParameters, getServiceInfo, getStatistic, and getClientStatistic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-5372

Affected Products

Sap As Java

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2017-5372 · Security Note
• http://packetstormsecurity.com/files/140611/SAP-NetWeaver-AS-Java-P4-MSPRUNTIMEINTERFACE-Information-Disclosure.html · Note
• http://securityfocus.com/bid/93504 · Note
• http://seclists.org/fulldisclosure/2017/Jan/50 · Note
• https://erpscan.io/press-center/blog/sap-cyber-threat-intelligence-report-october-2016 · Note
• https://erpscan.io/advisories/erpscan-16-037-sap-java-p4-mspruntimeinterface-information-disclosure · Note