CVE-2015-4091

Currently unrated

Key Information:

Vendor
SAP
Status
SAP Netweaver Application Server Java
Vendor
CVE Published:
26 May 2015

Summary

XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to "CIM UPLOAD," aka SAP Security Note 2090851.

References

http://packetstormsecurity.com/files/133122/SAP-NetWeaver...
x_refsource_MISC
https://erpscan.io/advisories/erpscan-15-013-sap-netweave...
x_refsource_MISC
http://www.securityfocus.com/archive/1/536239/100/0/threaded
mailing-listx_refsource_BUGTRAQ

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.