CVE-2015-2811

CVE-2015-2811 describes an XXE vulnerability in SAP NetWeaver Portal’s ReportXmlViewer (SAP NetWeaver Portal 7.31.201109172004). The underlying issue is that the SAP XML parser validates all incoming XML requests with a user-specified DTD, enabling external entities to be processed. This can lead...

SAP NetWeaver Portal ReportXmlViewer - XXE

Application: SAP NetWeaver Portal 7.31.201109172004 Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 06.11.2014 Vendor response: 07.11.2014 Date of Public Advisory: 15.03.2015 Reference: SAP Security Note 2111939 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class:...