Sign-up

ID

VAR-201302-0416


TITLE

SAP NetWeaver GRMGApp Security Bypass Vulnerability

Trust: 0.8

sources: IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01257

DESCRIPTION

There is a security vulnerability in SAP NetWeaver, and the application does not properly restrict access to GRMGApp, allowing an attacker to exploit the vulnerability to send administrative commands to the gateway or message server. SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. There is a security vulnerability in SAP NetWeaver. There is an unspecified error in GRMGApp when parsing external XML entities, allowing an attacker to exploit the vulnerability to read local file content

Trust: 1.44

sources: CNVD: CNVD-2013-01257 // CNVD: CNVD-2013-01259 // IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d // IVD: ccc04506-1f34-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 1.6

sources: IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d // IVD: ccc04506-1f34-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01257 // CNVD: CNVD-2013-01259

AFFECTED PRODUCTS

vendor:sapmodel:netweaverscope:eqversion:7.x

Trust: 1.6

sources: IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d // IVD: ccc04506-1f34-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01257 // CNVD: CNVD-2013-01259

CVSS

SEVERITY

CVSSV2

CVSSV3

IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d
value: MEDIUM

Trust: 0.2

IVD: ccc04506-1f34-11e6-abef-000c29c66e3d
value: LOW

Trust: 0.2

IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

IVD: ccc04506-1f34-11e6-abef-000c29c66e3d
severity: NONE
baseScore: NONE
vectorString: NONE
accessVector: NONE
accessComplexity: NONE
authentication: NONE
confidentialityImpact: NONE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: UNKNOWN

Trust: 0.2

sources: IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d // IVD: ccc04506-1f34-11e6-abef-000c29c66e3d

TYPE

Access verification error

Trust: 0.2

sources: IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d

PATCH

title:SAP NetWeaver GRMGApp security bypass vulnerability patchurl:https://www.cnvd.org.cn/patchinfo/show/32164

Trust: 0.6

title:Patch for SAP NetWeaver GRMGApp XML File Parsing Error Vulnerabilityurl:https://www.cnvd.org.cn/patchinfo/show/32165

Trust: 0.6

sources: CNVD: CNVD-2013-01257 // CNVD: CNVD-2013-01259

EXTERNAL IDS

db:SECUNIAid:52272

Trust: 1.2

db:CNVDid:CNVD-2013-01257

Trust: 0.8

db:CNVDid:CNVD-2013-01259

Trust: 0.8

db:IVDid:CF3DB9E4-1F34-11E6-ABEF-000C29C66E3D

Trust: 0.2

db:IVDid:CCC04506-1F34-11E6-ABEF-000C29C66E3D

Trust: 0.2

sources: IVD: cf3db9e4-1f34-11e6-abef-000c29c66e3d // IVD: ccc04506-1f34-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-01257 // CNVD: CNVD-2013-01259

REFERENCES

url:http://secunia.com/advisories/52272/http

Trust: 1.2

sources: CNVD: CNVD-2013-01257 // CNVD: CNVD-2013-01259

SOURCES

db:IVDid:cf3db9e4-1f34-11e6-abef-000c29c66e3d
db:IVDid:ccc04506-1f34-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-01257
db:CNVDid:CNVD-2013-01259

LAST UPDATE DATE

2022-05-17T01:43:25.801000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2013-01257date:2013-02-25T00:00:00
db:CNVDid:CNVD-2013-01259date:2013-05-24T00:00:00

SOURCES RELEASE DATE

db:IVDid:cf3db9e4-1f34-11e6-abef-000c29c66e3ddate:2013-02-25T00:00:00
db:IVDid:ccc04506-1f34-11e6-abef-000c29c66e3ddate:2013-02-25T00:00:00
db:CNVDid:CNVD-2013-01257date:2013-02-25T00:00:00
db:CNVDid:CNVD-2013-01259date:2013-02-25T00:00:00