CVE-2015-4091

CVE-2015-4091 describes an XML External Entity (XXE) vulnerability in SAP NetWeaver AS Java 7.4. The issue arises when the SAP XML parser at /sap.com/tc~sld~wd~main/Main processes incoming XML requests with a user-specified DTD (CIM UPLOAD), potentially allowing remote attackers to send TCP reque...

SAP NetWeaver AS Java CIM UPLOAD - XXE

Application: SAP NetWeaver AS Java Vendor URL: http://www.sap.com Bugs: XML External Entity Reported: 16.06.2014 Vendor response: 17.06.2014 Date of Public Advisory: 18.05.2015 Reference: SAP Security Note 2090851 Authors: Vahagn Vardanyan ERPScan VULNERABILITY INFORMATION Class: XML External...