PT-2017-12025 · Sap · Sap Netweaver As Java

CVE-2017-11457

·

Published

2017-07-25

·

Updated

2021-04-20

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions SAP NetWeaver AS JAVA version 7.5
Description The issue allows remote authenticated users to read arbitrary files or conduct server-side request forgery (SSRF) attacks via a crafted DTD in an XML request. This is an XML external entity (XXE) vulnerability.
Recommendations For SAP NetWeaver AS JAVA version 7.5, apply the fix provided in SAP Security Note 2387249 to resolve the issue.

Fix

XXE

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-11457

Affected Products

Sap Netweaver As Java