PT-2016-5629

CVE-2016-3635

Published

2016-10-13

Updated

2016-11-28

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SAP Netweaver version 7.4

Description The issue allows remote authenticated users to bypass an intended Unified Connectivity (UCON) access control list. This can lead to the execution of arbitrary Remote Function Modules (RFM) by leveraging a connection created from earlier execution of an anonymous RFM included in a Communication Assembly.

Recommendations For SAP Netweaver version 7.4, apply the fix provided in SAP Security Note 2139366 to resolve the issue.

Exploitability

Fix

Impacts

Researchers

Pablo Müller

Sergio Abraham

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers