SAP Netweaver Invoker Servlet Remote Code Execution Vulnerability

Bugtraq ID:	48925
Class:	Unknown
CVE:
Remote:	Yes
Local:	No
Published:	Jul 28 2011 12:00AM
Updated:	Jul 28 2011 12:00AM
Credit:	Onapsis Security
Vulnerable:	SAP NetWeaver 7.30 SAP NetWeaver 7.10 SAP NetWeaver 7.02 SAP NetWeaver 7.01 SAP NetWeaver 7.0 SP8 SAP NetWeaver 7.0 SP15 SAP NetWeaver 7.0
Not Vulnerable:

SAP Netweaver Invoker Servlet Remote Code Execution Vulnerability

SAP Netweaver is prone to a remote code-execution vulnerability.

An attacker may leverage the issues to execute arbitrary script code within the context of the affected application.

SAP Netweaver Invoker Servlet Remote Code Execution Vulnerability

An attacker can use a Web browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting user to follow a malicious URI.

SAP Netweaver Invoker Servlet Remote Code Execution Vulnerability

Solution:
Updates are available. Please see the references for more information.

SAP Netweaver Invoker Servlet Remote Code Execution Vulnerability

References:

• SAP NetWeaver Homepage (SAP)
  
• SAP Security In-Depth Volume 4: The Invoker Servlet - A Dangerous Detour into SA (Onapsis Security)