Vulnerability 72652 - CERT Civis.Net

Vulnerability Name:

CCN-72652

Published:

2012-01-20

Updated:

2012-01-20

Summary:

SAP Netweaver could allow a remote attacker to gain unauthorized access to the system, caused by improper handling of access controls. An attacker could exploit this vulnerability to gain access to restricted to Runtime Workbench resources.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: DSECRG-12-008
SAP Netweaver RWB - unauthorized ac?ess

Source: CCN
Type: SA47701
SAP NetWeaver Multiple Vulnerabilities

Source: CCN
Type: BID-51645
SAP NetWeaver Multiple Remote Vulnerabilities

Source: XF
Type: UNKNOWN
netweaver-runtime-unauth-access(72652)

Source: CCN
Type: SAP Web site
SAP Security Note 1567389

Vulnerable Configuration:

Configuration CCN 1:

cpe:/a:sap:netweaver:7.0:*:*:*:*:*:*:*

OR cpe:/a:sap:netweaver:7.01:*:*:*:*:*:*:*

OR cpe:/a:sap:netweaver:7.02:*:*:*:*:*:*:*

OR cpe:/a:sap:netweaver:7.10:*:*:*:*:*:*:*

OR cpe:/a:sap:netweaver:7.30:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK