Xxe

2015-05-2614:59:00

PRIOn knowledge base

www.prio-n.com

8.1 High

AI Score

Confidence

High

0.007 Low

EPSS

Percentile

80.2%

JSON

XML external entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4 allows remote attackers to send TCP requests to intranet servers or possibly have unspecified other impact via an XML request to tc~sld~wd~main/Main, related to “CIM UPLOAD,” aka SAP Security Note 2090851.

CPENameOperatorVersion
sap_netweaver_application_server_javaeq7.4

CPE	Name	Operator	Version
	sap_netweaver_application_server_java	eq	7.4

References

packetstormsecurity.com/files/133122/SAP-NetWeaver-AS-Java-XXE-Injection.html

seclists.org/fulldisclosure/2015/May/96

www.securityfocus.com/archive/1/536239/100/0/threaded

www.securityfocus.com/bid/74850

erpscan.io/advisories/erpscan-15-013-sap-netweaver-as-java-cim-upload-xxe