PT-2016-5629

CVE-2016-3635

Publicado

2016-10-13

Atualizado

2016-11-28

Descrição por

CVSS 3.1

7.5

Alta

MétricasAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Netweaver version 7.4

Description The issue allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list. This can lead to the execution of arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.

Recommendations For SAP Netweaver version 7.4, apply the fix provided in SAP Security Note 2139366 to resolve the issue.

Explorabilidade

Correção

Impactos

Pesquisadores

Pablo Müller

Sergio Abraham

Fornecedores

Produtos afetados

Enumeração de fraquezas

CWE-284: Improper Access Control

Identificadores relacionados