Vulnerability CVE-2014-8590
Published: 2014-11-04

Description:
XML external entity (XXE) vulnerability in the Web Service Navigator in SAP NetWeaver Application Server (AS) Java allows remote attackers to access arbitrary files via a crafted request.

Type:

CWE-Other

CVSS2 => (AV:N/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.3/10
2.9/10
8.6/10
Exploit range
Attack complexity
Authentication
Remote
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
SAP -> Netweaver java application server 

 References:
http://blog.onapsis.com/analyzing-sap-security-notes-october-2014-edition/
http://www.securityfocus.com/bid/71023
https://erpscan.io/advisories/erpscan-14-015-sap-netweaver-as-java-xxe/
https://erpscan.io/press-center/blog/sap-critical-patch-update-october-2014/
https://exchange.xforce.ibmcloud.com/vulnerabilities/98581
https://service.sap.com/sap/support/notes/2045176
Copyright 2024, cxsecurity.com

 

Back to Top