Sign-up

ID

VAR-201311-0406


TITLE

SAP NetWeaver Remote code execution vulnerability

Trust: 0.8

sources: IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14595

DESCRIPTION

SAP NetWeaver is the technical foundation for SAP Business Suite solutions, SAP xApps composite applications, partner solutions, and custom applications. SAP NetWeaver Portal has a vulnerability in handling GET requests sent through ConfigServlet, allowing remote attackers to execute arbitrary operating system commands using specially crafted requests

Trust: 0.72

sources: CNVD: CNVD-2013-14595 // IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d

IOT TAXONOMY

category:['ICS']sub_category: -

Trust: 0.8

sources: IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14595

AFFECTED PRODUCTS

vendor:sapmodel:netweaverscope: - version: -

Trust: 0.6

vendor:sapmodel:netweaverscope:eqversion:*

Trust: 0.2

sources: IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14595

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2013-14595
value: HIGH

Trust: 0.6

IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d
value: HIGH

Trust: 0.2

CNVD: CNVD-2013-14595
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.9 [IVD]

Trust: 0.2

sources: IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14595

TYPE

Code injection

Trust: 0.2

sources: IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d

EXTERNAL IDS

db:CNVDid:CNVD-2013-14595

Trust: 0.8

db:EXPLOITDBid:24963

Trust: 0.6

db:EXPLOIT-DBid:24963

Trust: 0.6

db:OSVDBid:92704

Trust: 0.6

db:IVDid:8EF25ADA-1EFC-11E6-ABEF-000C29C66E3D

Trust: 0.2

sources: IVD: 8ef25ada-1efc-11e6-abef-000c29c66e3d // CNVD: CNVD-2013-14595

REFERENCES

url:http://www.exploit-db.com/exploits/24963/

Trust: 0.6

url:http://osvdb.org/show/osvdb/92704

Trust: 0.6

url:https://service.sap.com/sap/support/notes/1445998

Trust: 0.6

sources: CNVD: CNVD-2013-14595

SOURCES

db:IVDid:8ef25ada-1efc-11e6-abef-000c29c66e3d
db:CNVDid:CNVD-2013-14595

LAST UPDATE DATE

2022-05-17T02:07:14.175000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2013-14595date:2013-11-22T00:00:00

SOURCES RELEASE DATE

db:IVDid:8ef25ada-1efc-11e6-abef-000c29c66e3ddate:2013-11-22T00:00:00
db:CNVDid:CNVD-2013-14595date:2013-11-22T00:00:00