PT-2020-7900
CVE-2015-7968
·
Published
2020-03-09
·
Updated
2020-03-10
Description by
CVSS 3.1
6.4
MediumMetricsAC:L/AV:N/A:L/C:L/I:N/PR:L/S:C/UI:N
Name of the Vulnerable Software and Affected Versions:
SAP NetWeaver Application Server before Security Note 2183189
Description:
The issue allows XXE attacks for local file inclusion via the "sap/bc/ui2/nwbc/nwbc ext2int/" URI. This can be exploited to access local files.
Recommendations:
For SAP NetWeaver Application Server before Security Note 2183189, apply Security Note 2183189 to resolve the issue. As a temporary workaround, consider restricting access to the "sap/bc/ui2/nwbc/nwbc ext2int/" URI to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾