Vulnerability CVE-2013-3244

Vulnerability Name:

CVE-2013-3244 (CCN-84040)

Assigned:

2013-05-06

Published:

2013-05-06

Updated:

2013-10-25

Summary:

Multiple unspecified vulnerabilities in the CJDB_FILL_MEMORY_FROM_PPB function in the Project System (PS-IS) module for SAP ERP Central Component (ECC) allow remote attackers to execute arbitrary code via a (1) RFC or (2) SOAP-RFC request.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.0 Medium (CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P)
4.4 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
5.5 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-94

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2013-3244

Source: CONFIRM
Type: UNKNOWN
http://scn.sap.com/docs/DOC-8218

Source: CCN
Type: SA53322
SAP ERP Central Component (ECC) PS-IS RFC Arbitrary Program Code Execution Vulnerability

Source: CCN
Type: ESNC-2013-005
Remote Code Injection in SAP ERP Central Component - Project System

Source: MISC
Type: UNKNOWN
http://www.esnc.de/sap-security-audit-and-scan-services/security-advisories/58-remote-code-injection-in-sap-erp-project-system.html

Source: CCN
Type: BID-59677
SAP ERP Central Component 'CJDB_FILL_MEMORY_FROM_PPB()' Function Remote Code Injection Vulnerability

Source: XF
Type: UNKNOWN
sap-erp-code-execution(84040)

Source: CCN
Type: SAP Web site
SAP Security Note 1776695

Source: MISC
Type: UNKNOWN
https://service.sap.com/sap/support/notes/1776695

Vulnerable Configuration:

Configuration 1:

cpe:/a:sap:erp_central_component:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK