SAP NetWeaver Web Dynpro Live Update XML External Entity Information Disclosure Vulnerability
BID:63302
Info
SAP NetWeaver Web Dynpro Live Update XML External Entity Information Disclosure Vulnerability
| Bugtraq ID: | 63302 |
| Class: | Design Error |
| CVE: |
CVE-2013-6244 |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 23 2013 12:00AM |
| Updated: | Dec 31 2013 12:19AM |
| Credit: | Arseny Reutov of Positive Technologies. |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
SAP NetWeaver Web Dynpro Live Update XML External Entity Information Disclosure Vulnerability
SAP NetWeaver is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Given the nature of this issue, attacker may also be able to cause a denial-of-service condition.
SAP NetWeaver is prone to an information-disclosure vulnerability.
An attacker can exploit this issue to gain access to sensitive information that may lead to further attacks. Given the nature of this issue, attacker may also be able to cause a denial-of-service condition.
Exploit / POC
SAP NetWeaver Web Dynpro Live Update XML External Entity Information Disclosure Vulnerability
An attacker can exploit this issue using readily available tools.
An attacker can exploit this issue using readily available tools.
Solution / Fix
SAP NetWeaver Web Dynpro Live Update XML External Entity Information Disclosure Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
SAP NetWeaver Web Dynpro Live Update XML External Entity Information Disclosure Vulnerability
References:
References:
- SAP Web Dynpro Homepage (SAP )