Sign-up

ID

VAR-201301-0514


TITLE

SAP NetWeaver CCMS service XML Parser Information Disclosure Vulnerability

Trust: 1.7

sources: IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-00703 // BID: 57654 // CNNVD: CNNVD-201301-622

DESCRIPTION

SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. There is an error in the CCMS service XML parser when validating the XML request. Allows an attacker to exploit a vulnerability to obtain local file information. SAP NetWeaver is prone to an information-disclosure vulnerability

Trust: 0.99

sources: CNVD: CNVD-2013-00703 // BID: 57654 // IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-00703

AFFECTED PRODUCTS

vendor:sapmodel:web application serverscope:eqversion:7.0.10

Trust: 1.1

vendor:sapmodel:netweaverscope:eqversion:7.10

Trust: 0.9

vendor:sapmodel:netweaverscope:eqversion:7.30

Trust: 0.9

vendor:sapmodel:netweaverscope:eqversion:7.02

Trust: 0.9

vendor:sapmodel:netweaverscope:eqversion:7.01

Trust: 0.9

vendor:sapmodel:netweaverscope:eqversion:7.0

Trust: 0.9

vendor:sapmodel:web application serverscope:eqversion:7.0

Trust: 0.9

vendor:sapmodel:netweaverscope:eqversion:7.10*

Trust: 0.2

vendor:sapmodel:netweaverscope:eqversion:7.30*

Trust: 0.2

vendor:sapmodel:netweaverscope:eqversion:7.02*

Trust: 0.2

vendor:sapmodel:netweaverscope:eqversion:7.01*

Trust: 0.2

vendor:sapmodel:netweaverscope:eqversion:7.0*

Trust: 0.2

vendor:sapmodel:web application serverscope:eqversion:7.0*

Trust: 0.2

sources: IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-00703 // BID: 57654

CVSS

SEVERITY

CVSSV2

CVSSV3

IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

sources: IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201301-622

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201301-622

PATCH

title:SAP NetWeaver CCMS Service XML Parser Information Disclosure Vulnerability Patchurl:https://www.cnvd.org.cn/patchinfo/show/31354

Trust: 0.6

sources: CNVD: CNVD-2013-00703

EXTERNAL IDS

db:BIDid:57654

Trust: 1.5

db:CNVDid:CNVD-2013-00703

Trust: 0.8

db:CNNVDid:CNNVD-201301-622

Trust: 0.6

db:IVDid:9C2E460E-1F39-11E6-ABEF-000C29C66E3D

Trust: 0.2

sources: IVD: 9c2e460e-1f39-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-00703 // BID: 57654 // CNNVD: CNNVD-201301-622

REFERENCES

url:http://erpscan.com/advisories/dsecrg-12-049-sap-netweaver-ccms-xml-external-entity/http

Trust: 0.6

url:http://www.securityfocus.com/bid/57654

Trust: 0.6

url:http://erpscan.com/advisories/dsecrg-12-049-sap-netweaver-ccms-xml-external-entity/

Trust: 0.3

url:http://www.sap.com/platform/netweaver/index.epx

Trust: 0.3

sources: CNVD: CNVD-2013-00703 // BID: 57654 // CNNVD: CNNVD-201301-622

CREDITS

Alexey Tyurin of ERPScan

Trust: 0.9

sources: BID: 57654 // CNNVD: CNNVD-201301-622

SOURCES

db:IVDid:9c2e460e-1f39-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-00703
db:BIDid:57654
db:CNNVDid:CNNVD-201301-622

LAST UPDATE DATE

2022-05-17T02:02:35.665000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2013-00703date:2013-02-04T00:00:00
db:BIDid:57654date:2013-01-31T00:00:00
db:CNNVDid:CNNVD-201301-622date:2013-02-04T00:00:00

SOURCES RELEASE DATE

db:IVDid:9c2e460e-1f39-11e6-abef-000c29c66e3ddate:2013-02-04T00:00:00
db:CNVDid:CNVD-2013-00703date:2013-02-04T00:00:00
db:BIDid:57654date:2013-01-31T00:00:00
db:CNNVDid:CNNVD-201301-622date:2013-01-31T00:00:00